There’s always a possibility of someone posting arbitrary content when a platform allows user content or combines content from many sources. I mean we do have moderation here and illegal content is supposed to be removed or flagged. However as the operator of some internet service, you are ultimately responsible for what’s on your instance. So you definitely do need to make an effort to stay in control. Btw, there are possible compromises, such as using an allow-list of instances you federate with, so you don’t pull content from sources you don’t trust and didn’t approve.