I picture the problem being someone doing that low-key. It’s common for app developers to get offers to install privacy-violating code in exchange for very tempting amounts of money - like, have a somewhat successful piano or to-do list app that you make $15k a year from? Wel, how about you install this spyware crap and we’ll give you $60,000. It’s difficult for small developers to say no. I could picture the same thing happening with Lemmy instances - a small change in ToS, some new JavaScript, and many people wouldn’t notice. At this point Lemmy members skew towards tech and privacy aware, but it could happen later on as the membership broadens.