It reads like someone has just discovered that if you toss out public data on the public internet via federation it becomes public and out of your direct control.

That’s how all federated services basically work: once it is relayed to someone else’s server, there’s essentially nothing you can do to force deletion.

Easy example: if you send me an email, but delete it from your sent messages, did you delete the message I got?