Lemmy actually has both allowlist and blocklist modes. I think the default is blocklist because there are a lot more niche/single-user instances that are legitimate than ones that aren’t.