Or have I misunderstood?
I suspect the response will be that content on your instance should always be considered public, and that you can’t really stop a bad actor from spinning up fake instances or scraping your site for the data regardless, but I just wanted to confirm.
Maybe I’m wrong, but I had understood that the content on your instance would also not be pushed to them, after defederating. The only thing you can’t stop is having that instance see your comments and posts on another instance (not your own or the one you defederated from).
No I think you’re right and I’m wrong, it does appear to work that way.
My confusion came from the beehaw de-federation with lemmy.world and it seemed like at one point traffic was a one-way street, but if you go to a beehaw community now via lemmy.world vs from beehaw.org you can see that beehaw content is not arriving at at lemmy.world (because beehaw defederated them), even though lemmy.world has not defederated from beehaw.