You haven’t discussed either your jurisdiction or what you’re worried about hosting. But in general, if you’re hosting a service for others… yes… they can create legal liability for you. And with lemmy specifically it’s not just what your users create, but what they subscribe to since subscribed content gets replicated to your instance and then served to the unauthenticated public internet.
People/companies obviously do host things safely, but you need to learn how things work in your local jurisdiction. Like on the US, you need to register as a copyright agent to get DMCA protection, failure to do so could expose you to personal liability for the copyright infringement others sub/create. For CSAM (aka child porn), you may be required not just to remove but to report it as well.
There are definitely people hosting Lemmy instances today who have no understanding of the legal implications of doing so are are not taking the necessary precautions to protect themselves. The vlemmy instance just disappeared without warning or communication, and while no one knows why, it’s not out of the question that they got spooked by a child-porn situation or got their server raided by police (this is speculation, but it’s possible). Other instances will disappear at some point when admin responsibilities get real.
Your most important responsibility as an admin is understanding the legal/compliance environment you operate in and doing whatever is required of you to host safely. It’s not a trivial task, but people do it successfully.