This is mostly a client problem. Mastodon has propagated some pretty lax behaviour with respect to adherence to the ActivityPub protocol, mostly because their r

This is mostly a client problem. Mastodon has propagated some pretty lax behaviour with respect to adherence to the ActivityPub protocol, mostly because their reach is very large in comparison with the other projects, and because they just mapped their existing API on top ActivityPub (which was finalized post Mastodon being popular) and that was their existing use case. The ActivityPub protocol itself makes it very simple to keep activities out of the public view. It's Mastodon, and projects that implement AP as a compatibility layer with it that address everything as public.