Honest question, how would they be able to do damage via the federation protocol?

My understanding was that it sends data regarding posts comments and actions to all servers.

The closest I thought I had was some kind of instance ban but while that gets federated, it doesn’t result in a ban elsewhere

Instance a bans user foobar Instance b sees this information but foobar is not banned by instance b.

We saw some of that with the hexbear drama a couple of months back