Why are Mastodon instance owners having to create blocklists of domains? Does the ActivityPub protocol not authenticate people and just anyone can dump garbage

Why are Mastodon instance owners having to create blocklists of domains? Does the ActivityPub protocol not authenticate people and just anyone can dump garbage into it? If people link their instances together are they not authenticating/validating one another? I've read all the linked articles and it still doesn't make any sense to me how this attack could be possible. Do Mastodon allow anonymous/new instances to automagically link to one another or is something else going on? Or are these just individual bots registering on each individual instance and Mastodon implemented its own MTA? If this is the case, reconfigure Mastodon to use a local MTA and just hand this work off for Postfix to handle. If the queues grow too big there are dozens of different proactive ways to tune the queue management to deal with abuse even before considering whack-a-mole spam-domain lists. One could use pflogsumm to see what emails are stuck in queues and feed that data back into Mastodon without ever placing a load on Mastodon itself.