The best part of the fediverse is that anyone can run their own server. The downside of this is that anyone can easily create hordes of fake accounts, as I will now demonstrate.
Fighting fake accounts is hard and most implementations do not currently have an effective way of filtering out fake accounts. I’m sure that the developers will step in if this becomes a bigger problem. Until then, remember that votes are just a number.
Based on that suggestion, I think you may not understand the core of the problem. The issue isn’t that it’s possible to create bots, but rather that it’s easy to lie to other servers.
I can make my server pretend to host a billion accounts with unique phone numbers and pronounceable English names. I can set all the necessary flags that make it look like registration is whitelist based. I can make the web UI pretend I manually pick and choose the servers I federate with. I can even make the server generate fake communities with fake posts and fake responses on the fly whenever someone visits in a web browser.
Given original enough posts (ChatGPT?) an instance admin looking at my server at a glance would never notice. In fact, with this setup it shouldn’t be that hard to set up a “popular” server that will attract a ton of real users too.
Defederation is the only solution, but that can be circumvented at the cost of about three to five dollars per domain.