It's not hard to identify if you're looking for it, they just use one instance, they aren't subtle about it, and they are only boosting a specific company instead of a variety of products and ideas.

Vote manipulation is hard enough to detect on Reddit where they have visibility top to bottom. I think this will become a major issue in the future.

This is on top of the already significant scaling issues votes are causing.

Other instances can cache the total count for historical reasons, to preserve lost instance vote counts, but keeping the full ledger is going to be a serious barrier to entry for hosters and a security (manipulation) issue.

A whitelist defeats the decentralisation and openness of a defederated system.

I think you're mistaken in your assumption it would be easy to identify malicious instances. Bots are notoriously difficult to fight, every time you block one method another workaround will appear.