ADMIN/MOD ABUSE: Redditors are no strangers to mods/admins nuking comments, astroturfing, signal boosting/silencing, and so on. Doesn’t that problem just become worse in a federated system? As an example, a subreddit mod may ban users for whatever reason, but a lemmy instance admin could drag all their communities into their own drama if they choose to defederate, no? Losing access to entire instances instead of just one community/subreddit based on a power-tripping admin seems a big flaw. Am I missing something?

Yes and no. There are certainly concerns with "little dictators" hosting instances or individuals with an agenda manipulating content on their instance. The difference to a site like reddit or twitter is that this power and influence stops at the instance border, nobody controls lemmy, so people can always migrate to another instance if something like this happens.

And with reddit, admins don't just control individual subreddits. There are of course admins that control all of reddit.

REPOSTING/X-POSTING: Reddit was already just the same tweets posted to like forty different subreddits, recycled weekly. On lemmy, there are now a handful of instances that contain virtually the same communities too. The lemmy.world/c/memes and lemm.ee/c/memes communities will post virtually the same content. And that’s just one. Aren’t feeds going to be overrun by duplicate posts in /All?

This is just an normal characteristic of decentralized services in general and I think it will resolve itself over time. There are of course also many different websites that host similar content and there are similar subreddits that host similar content. Over time, one will establish itself and become the main community.

I have no clue about this… are there extra security or privacy issues with something like lemmy?

Information tends to be more transparent and open on the fediverse. Stuff you post on lemmy is not private. Your personal information you provide when signing-up is of course readable by the person who hosts the instance or people who have admin access. However, at the moment at least, lemmy instances are not run for profit and don't use/sell your data for profit.

There are privacy concerns, there are always privacy concerns. It's important to teach users how to protect themselvs by consciously controlling what information they reveal about themselves. This is much more important and effective than trying to control what others might do with your information.

This kinda goes without saying, but a small instance will already struggle to host even their own local users as traffic increases.

Here I have to speculate because I just don't know enough about the technical side of it. At the moment, most issues seem to be cause by software bugs, not by too much traffic or hardware performance.

Handling high amounts of traffic and activity is always tricky. I believe scalability will probably be an issue that will arise, maybe sooner than later, but I don't think it's an unsolvable issue.