I think any federated service is more vulnerable, because there’s no central oversight of e.g. IPs used to create accounts.

Even without any code, you could easily register accounts at the 20 largest instances and upvote yourself. I’m sure some people will have done just that.