Application is important because applying means you're motivated enough to take the role. Also limiting to people who have an account in the instance.
And yes, you bring a good point, random people can and should participate in it.
Csam was the true bane, and while cloudflare does have some protection, I am actively looking for better ways, even thinking of using qwen or deepseek v4 for specifically that. Except with open weight models it's not just the model but who's hosting it that's also something one must take into consideration.
I believe admins would be good enough for spam, csam and scam stuff, let's see though how it works out first