Is this where that happens? I am having a hard time untangling all the AP stuff in the codebase.

For what it's worth, I don't think this is the case any longer. I have been spinning up new dev instances a ton with docker and the trusted instances list is empty. The one place that piefed.social is listed in the admin panels I found is in the "Warn if new account banned from these instances" box:

I have been on a bit of a mission to try to make a lot of the more opinionated moderation tools in piefed optional at an admin level or remove them (so far rimu has been receptive). So, if this is in the code, I would want to make a PR to remove it.