They usually don’t have a choice. They know this stuff is bad, but they need it to demonstrate compliance with XYZ framework so they can fill out the marketing copy so sales can land a contract with some big customer that wants to know why $competitor has better security than you.
I used to self host email and got sick of my emails never getting through. Email is federated in theory, but pretty centralized in practice. Paying for Proton was definitely worth it.
I’ve been running a private instance for about a week and would like to know some of these too. My understanding is the banned users are users that other instances ban, and that information also federates to you. For the other two questions, afaik dumping the db is the only way to check users? And I’m not sure about the timeouts. I find it helps to periodically restart the lemmy service(s) on a cron.
The best feedback I ever got on an assignment in grad school was “wow, your homework looks like a textbook!”
It may not always be correct, but it’s always pretty!