In an article written in Japanese, the author points out the differences in maliciousness between Bluesky and other Fediverse services.

For example, while Mastodon administrators can access blocking lists that include federated users, Bluesky's access is not limited to administrators and is publicly available as a fully public API not found in the official app.

https://clearsky.app/whitehouse-47/blocking/blocked-by

Both Mastodon and Bluesky fail to implement measures such as notifying users of this fact when they make their first reaction, but Bluesky's particular maliciousness lies in its excessive disclosure of API permissions.

At least I believe Bluesky should have limited its API permissions to the same level as Mastodon.