This is a line of thinking that just supposes we shouldn’t post things on the internet at all. Which, sure, is probably the right move if you’re that concerned about OPSEC, but just because ActivityPub has a flakier model doesn’t mean it isn’t being watched
Even if everyone is on bsky.social, that's still a huge improvement on the status quo. It's not like the web isn't decentralised just because lots of people are on AWS - you can move away at any moment, adversarially if necessary.