Today I heard an interview on NPR with a Mastodon instance admin. Besides the good points, a few vulnerabilities were discussed:
1) The need for instance admins to be in communication to collectively ban trolls, racists, etc.
2) Inferior security compared to Twitter which (in their words) had a top security team.
3) Nation-state bad actors targeting users in interest-specific instances (ex. journalism). DMs a target in particular.
//
Guess where these things are NOT an issue?