Abolutely necessarily.
it works like this:
@privateuser@mastodon.example.comhas a "followers only account".@someuser@pixelfed.example.comis a friend of above account, requested access and was granted. This now causesmastodon.example.comto push all messages of@privateusertopixelfed.example.com.@anotheruser@pixelfed.example.comrequests access, but gets ignored. But the pixelfed instance marks the user as "follows@privateuser"- In the interface of
@someuser, the messages are shown as expected. - In the interface of
@anotheruser, they are also shown. Because PF basically does a database "select messages of users that the user follows", without checking if the access was ever granted.
Important to note, that this would not happen, if the messages weren't already pushed to the server due to the "allowed" user
We're basically horror movie tropes