Lemmy is compatible with bots which can cause some serious headaches, however there are tools that can combat these.
Every instance of Lemmy has a reputation that is associated with it. If it becomes clear that a particular instance is being used as a bot hub and the moderators are unresponsive then other instances will quickly start to black list it for being too spammy. More so if word starts to get out about it. Point is that the admins of an instance will make a good job of ensuring their users aren’t bots (or at least being misused as a bot) or face their whole instance being blocked across the board.
Even if the bots have their own instance then other instances will resort to enforcing whitelists for connections. Over time we may also see the development of additional mod tools too.
Microsoft aren’t exactly big on implementing “the latest” stuff. Not at a keyboard currently but I’d be willing to bet GH doesn’t support TLS1.3 either.