carbon_based

Umm... I was not so very clear perhaps. The idea would still be that user accounts as well as forums all contain their domain name, as their site of origin rather than a location identifier. Just that the host could change to any other domain (after negociation with the new host, that is). So it's not about domains being tied to specific hosts/IPs but entities being tied to domains. It would be up for design discussion if that identifier should change or not, iin the case of a migration. The idea would be to give entities the ability to roam or be resurrected from any federated copy in case they are dissatisfied with the policies of their hosts, or in the event a domain gets taken down by authoritrian actors. (That's why this actually is off-topic here)

From my glance into the ActivityPub doc, I concluded that it's really only about the data exchange protocol, yet I might have overlooked something as I never had an in-depth talk with people who implement the thing. Yet, just because many do it in a certain way does not mean to me that this is written in stone somewhere. :-)

[OT; tl/dr: the issues with forums and user accounts being under hegemony of server instances is by design but it's not actually the way one would design a truely de-centralised network]

It's a feature but not the best practice if the idea would be forums (and users) being free of domains (and the dangers of domains being taken down, and host admins' whims). The design approach of Lemmy however, speaks "hegemony" all over. It says a lot about the mindset of its creators.
An alternative would be indeed distributed directory systems, employing concepts like DHT ... well proven de-centralized resiliency for quite a while. Would it have been done in such a way, there would be no difficulty with migrating forums and users across instances, and even a domain getting lost would not necessarily lead to all forums/accounts there-on to be lost. Also the issues with link creation across instances were due to forums being bound to domain names instead of them having Universal IDs thus being agnostic of which node they are actually hosted on.

ActivityPub, AFAIK only defines a protocol for communicating datasets between instances, not the structures in which federation should be done.

If posted text is not properly "escaped" (meaning possible HTML tags and scripts made non-executable), an attacker can post ("inject") javascript in a comment which is then loaded and executed on other people's browsers. It seems that such a method was used to steal log-in cookies from admin's browsers. The attacker then could log in as the admin and proceed to change stuff in other areas of the site.

Edit: someone posted a screenshot of an app displaying the scipt here: https://lemmy.sdf.org/comment/850269 -- the app doesn't execute JS but displays it as text. That might be the safest way to go atm while malicious comments are spreading over the net.
(From that post we also learn about a fix that came almost immediately, so hopefully this issue is being done with as soon as all vulnerable servers have been updated)