Note: what I'm going to say represents my personal beliefs, based on some reasoning. Take it with a grain of salt.

Doesn’t that problem [admin/mod abuse] just become worse in a federated system?

Admins: no, because the admins of any given instance have less power over the whole than the admins of a centralised system, and it's considerably easier to mass migrate across instances than from a centralised site to another.

For a practical example: imagine that your instance admin goes rogue and says "fuck the users, I want profit". Now imagine that the admins of a centralised site do the same.

Mods: the federation itself has a smaller impact on mods than on admins, but it gives them less room for power abuse. Since each instance is smaller, the admins of said instance are more likely to intervene if some of their mods go rogue. And you'll also see more communities around the same topic around instances, so people don't concentrate so much on the same comms as you'd see Reddit users gathering into a single subreddit.

Also note that, while unrelated to the federation itself, Lemmy has built-in transparency tools like mod log. It's harder to be a shitty mod here and get away with it.

Losing access to entire instances instead of just one community/subreddit based on a power-tripping admin seems a big flaw.

It's a fucking big annoyance, but it's a feature, not a flaw. Sometimes the simple threat of defederation forces admins to act (that's actually good).

And, if instance A defederates instance B, members of the instance A lose access to the content of the instance B, and nothing else. (Until they set up alt accounts in instance B to work around it.)

Aren’t feeds going to be overrun by duplicate posts in /All?

So far I don't think that this is a bigger or smaller issue than in Reddit.

I have no clue about this… are there extra security or privacy issues with something like lemmy?

You could argue that privacy is a bigger concern here, indeed, as anything that you post in one instance is hosted in other instances. However, given the nature of social media, you should be already posting with an "anything that I post here is publically available" mindset, be it here or in Twitter or Reddit or Facebook or any other place.

Server issues

I'm ignorant on the technical side of the things, so I won't voice my take on this.