Well, while everything tarketed to Europeans (having EU domains is enough) should follow GDPR including the right to be forgotten, the whole issue is a bit more complex than most people seem to think.

For one, things not marketed to EU citizen don't count. And the owner of a website, this case the hoster of an instance, is responsible for this. Not the software they use (Lemmy). I don't think Lemmy tracks you specifically, as the code is open source and people likely would've noticed that by now. But servers could theoretically. That's why you need to choose a server you trust, or host your own.

An instance aimed at USA people hosted in the USA doesn't need to be GDPR compliant while a German one hosten in Germany would. An instance aimed at the world hosted in the USA also would, but likely breaks GDPR simply by being hosted in the USA. That's part of why big social media need EU servers.

A federated system is not in one place, and another issue is that while deletion requests could be send (and Lemmy supports this accourding to their website), it can't be as easily enforced to be followed by third parties. Of which, there are a lot in a decentral place.

Think of this: If I post something on Reddit, it get's reposted to 4chan, then I remove my original post, then it's still on 4chan. I could ask them to remove it, but that would likely be declined. Since 4chan has little to do with the EU and it's citizen, and doesn't actively market itself, they have little to do with the GDPR. At best you could make a copyright based claim, but that'll change it into a whole other topic.

Federated systems similarily take eachothers content. It's important to note that generally Federated networks don't push their content to other instances. Instead, other instances grab them from each other. How often has federation not gone smoothly causing deleted Mastodon posts to still show up on otger instances because they grabbed the post but not the deletion request (I've seen it happen multiple times already).

The right to be forgotten forces them to make it anonymous and untracable upon request, but not to delete every word you ever typed. Anonymising your account and deleting traceble info only would be enough. That means, if the server you requested to deletes their part + send a request to third parties they deliberatly send info to themselves, they did their job as far as law is concerned.

Any third party that grabbed the info by themselves, would require you to send a new request to them. Considering federation works by grabbing other instances, not by pushing your instance to others, any federated post that still has your old info could still be up if changes or deletion requests haven't been processed.

So is Lemmy bad for privacy by default? Not anymore than the rest of the web, as long as you understand that the whole point of decentral systems mean it's not one place. Best to always keep in mind that everything on the internet is forever and public, even if you delete it or use filters on who can see it, as you can never ensure no one copies it and post it elsewhere.