Post privacy on the fediverse is kind of a disaster, no one should ever rely on that ever. It will keep happening because it’s an easy mistake to make and it puts all the privacy controls onto the receiving instance’s hands, so as a user you can’t do anything about it. Anyone can try their own spin on Fediverse servers and make that mistake easily. If Lemmy could subscribe to users it probably would also be affected by this.