It's not a risk of content exposure. By definition, risk is something that may or may not happen. Federating private content is guaranteed content exposure.

There are websites that make it easy for anyone to see exactly who voted on a post. In a similar way, making a site that ignores or highlights private content is an inevitably. Not to mention federated software that doesn't even know what private content is and will publish it with no malicious intent.

It's very easy to federate and create your own federated database without the intent of actually using it for piefed/lemmy/etc... It's one of the biggest downsides to the fediverse: privacy is impossible. Absolutely nothing is stopping Facebook, Google, or anyone else from setting up an instance and gaining direct access to all federated data.