That's completely fine, but just because a knob can be lockpick doesn't mean you leave it unlocked.

Granted I have very little experience with activity pub, but I would expect that it should be very possible to have something similar to how defederating Works where if you don't allow it to be sent to a specific Community it just won't communicate.

edit: Looking back at it though, it wouldn't stop them from just opening a secondary instance nobody knows about, having it set to private and then just running it as an info collector I don't think.