I’d argue, oddly, that it’s easier to hold a single corporate entity accountable for data breaches than mastodon instance owners.

It’s likely the case that both of are bad from a data security point of view, but at least with the corporations you know who to shout at.

I'm inclined to agree, albeit I'm of two minds about it. On one hand, singular entity is technically easier, but being corporate means it's likely to have more wealth/resources to make it untenable for people to hold accountable. Whereas on the other hand, if you put in the effort to pin down a Mastodon instance admin or even a few admins, chances are they won't have those kinds of resources to really defend themselves, so you may be more likely to hold them accountable.

That is, compared to a corporate entity which may drag things out for a slap on the wrist settlement/fine or the like. I can see the different angles to where you're coming from though.

First, I agree with what you're saying here about the privacy issue.

The other side of that is that companies or even individual journalists could just spin up their own instance and not allow outsiders to sign up.

However, there needs to be a critical mass of engaged people. I don't know what Mastodon's engagement looks like but I can't imagine it's very high. With even the slightest barrier to entry beyond "sign up with your email address on our main site" there will never be as much engagement as a simpler platform. On top of that, a lot of news outlets consider hot takes on the social media site formerly known as Twitter to be news. So they embed dumb opinions from there in loads of "articles".

It's going to be a long road for them to leave and when they do it likely won't be to join the Fediverse.

Edit: except possibly the BBC. Maybe if their trial pans out others would follow. We'll see.