The decentralization is there, but in theory the owner of the largest node could defederate from everyone else, forcing users to leave the largest instance or put up with it?

It would be a lot like Meta in that way - the only reason it has survived is because everyone was already there and there’s no way in hell to get everyone to switch to the same new thing. I genuinely don’t know which direction users would go, lemmy users are an odd bunch.

That’s literally just pen testing, though. You search through tons of holes just to find the tunnel you were going down was blocked and not an issue.

This doesn’t really solve the problem. Security through obscurity has always been the laziest and least effective method to secure your code