I mean in general. Having a server connected to the internet is always a risk. Doesn’t have to be Lemmy that’s exploited.

And if they have an open registration it’s still their servee that can be used to distribute images unchecked.