This is a line of thinking that just supposes we shouldn’t post things on the internet at all. Which, sure, is probably the right move if you’re that concerned about OPSEC, but just because ActivityPub has a flakier model doesn’t mean it isn’t being watched
Even if everyone is on bsky.social, that's still a huge improvement on the status quo. It's not like the web isn't decentralised just because lots of people are on AWS - you can move away at any moment, adversarially if necessary.
Looking forward to the future where an app just sort of silently backs up your PDS/keys on your device until the day you need it and everyone finds out they can log into whatever platform replaces the one that blew up like nothing happened.