they won't be sent by infosec.pub directly, but other instances may send activities referencing content from infosec.pub, which will lead lemmy.ml to pull it from the source as well.
this includes for example posts and comments in lemmy.world communities, because lemmy.world will announce those to lemmy.ml.
this doesn't really change anything for how remote users are displayed, it's a change to properly support hosting lemmy-ui on a different domain than the lemmy backend/api.
what are you referring to with mastodon short.domain handles?