Federation is managed at an instance level, by the administrators of that instance. Instances can take either an accept-list approach or a block-list approach. As an end user, you choose to de-federate from it by choosing an instance which de-federates from it (or by running your own instance). The moderation / personal block tools on Lemmy aren't as sophisticated right now as they are on Mastodon, but ideally you should also be able to personally block instances from accessing your account as well.

A lot of third party communication occurs on the Fediverse though. If a community is hosted on server A, you come from server B, and another user comes from server C, it is reasonable to ask if server A will just hand server B's content (replies, votes, etc.) to server C. On Mastodon, this is the default behavior, unless an instance enables the "Authorized Fetch" option. I am not sure how this works on Lemmy.

For the meantime though, Threads is focused on the microblogging format of social media, and compatibility with Mastodon in particular. Lemmy is probably less at risk. But you should still treat every public post like it is truly public. People run scrapers. People run bots. People can take snapshots on archive.org. Federated platforms are no different in this regard.