Mostly agreed, though this is more accurate about ActivityPub than federated stuff in general. There are privacy focused things, they just tend to lean closer to being fully decentralized (or at least feel like it).

ActivityPub, and Mastodon in particular, is very public-oriented though yeah. The feature-set and discovery stuff is pretty much inherently un-protectable.