I thought Mastodon was default whitelist whereas email was default blacklist, no? In other words, if you don't explicitly take action (i.e. follow) nobody can

I thought Mastodon was default whitelist whereas email was default blacklist, no? In other words, if you don't explicitly take action (i.e. follow) nobody can send you a message on Mastodon? I thought that was how it was implemented, but please correct me if I'm wrong.