What could a single user instance possibly do to be defederated on a massive scale? And at that point, why not simply join another instance?

You would, but that’s where your firewall and SSL certificates come into play. I use a reverse proxy and forward port 80/443 directly to it. Everything I host resolves to a CNAME in Cloudflare and my proxy responds with a 404 to any unknown requests.

Yes, but by proxying your traffic via cloudflare your domain will point to their IP instead of yours directly.