Mastodon is federated SocialMedia: users can post and comment on their instance, and they can subscribe to accounts on other instances as well. The servers communicate with each other, exchanging all the messages that need to be delivered to outside servers. So far so good. This is handled by the ActivityPub layer.
Mastodon and many compatible also has privacy settings: public posts, unlisted posts (anybody can read them if they know where to look, they aren’t listed on the public timelines), followers only (only their followers can read them, which probably only makes sense if you curate your list of followers), and direct (only the accounts mentioned in the post can read it). This is handled by the server software, so there are multiple issues: malicious servers don’t need to abide by these conventions; when instances introduce new conventions (like that one time Mastodon added these conventions), and other instances don’t know about them (like all the technically compatible [[Pleroma?]] instances out there), then you have a privacy nightmare because the posts that were supposed to be hidden are not always hidden; also system administrators have full access to the messages since they are not EndToEndEncrypted?.
Finally, there’s an emergent problem: hidden harassment.
If you’re being harassed by accounts using messages not every body can see, you’re engaging in hidden harassment. This can happen elsewhere as well: If you have a blog and every time you post you receive a ton of harassment via email, this is equivalent. On a blog, however, it’s possible to write anonymously. There simply is no way to contact you in a hidden way unless your email address is available. Harassment in the comments is not quite equivalent, since those are public, for all to see. On social media, this isn’t possible since your handle is always your address. People can always reply. Even if you can disable comments on a post, people can harass you via direct messages.
The only countermeasure is an ever increasing block list. As harassment campaigns can involve many accounts, and can potentially be automated, people are effectively driven off social media. After all, if your social media instance ends up blocking most of the other instances, are you even federating any more?