public timelines, enable whitelist federation and require authorized fetch for federating

And all of that can be circumvented by pulling the data via the RSS feeds or plain old scraping.

Authorized fetch and domain blocks may be effective to stop drive-by trolls, but do nothing to stop anyone with a minimal amount of resources and interest in scraping data from a social network.

The reality is simple: all information that you put on the web should be considered as publicly available. Those that want or need absolute privacy should not use information in the fediverse and resort only to provably secure communication protocols.