Am I right in assuming that - API wise - the bot only interacts with ponder.cat, and doesn’t make calls to the remote instance? (I’m wondering if there’s any barriers to it operating with communities that aren’t on a Lemmy instance).

Yes, that's right. It should work fine on a non-Lemmy instance.

Does the bot resolve the human first, check what they moderate, and then resolve the community if they moderate it, or just always resolve the community, and then compare its moderators with who made the request? If its the latter, this could be a way for bad actors to crowbar a community onto your instance (assuming it doesn’t purge it if things don’t match up, of course).

It's the latter. I think it's okay. The same thing can happen on any instance where someone can search for a community from any other instance.

What would have happened if Otter had sent /add https://lemmy.ca/feeds/c/medicine.xml medicine@lemmy.ca ? Would this be like that time when someone put ‘google’ into google.com, and the Internet blew up?

It's limited to one posting every 5 minutes per feed, so the damage would be limited, but you're right that it would enter an infinite loop and post once every five minutes until someone put a stop to it.