Yes, but for example if everyone is running the mainline code, and .ml decides they are going to run a version which does not respect federation updates under certain conditions, they could quietly poison the entire fediverse by spoofing updates from other instances. It's very obvious that they are already selectively federating their modlog, for example. And some other instances already play games with how votes get reported. There is a lot of trust baked into the federation updates, and nobody knows how to exploit that better than dessalines, who is clearly very interested in using the platform to push a specific ideology.

I am absolutely in favor of forking Lemmy to get this out of their hands, fwiw. Specifically for this reason. I think they've shown that they are not above poisoning the code base exactly like this.