and if they join the Fediverse, of course they’re going to harvest data from anyone federating with them too.
From the Mastodon blog post about Meta federation:
Will Meta get my data or be able to track me?
Mastodon does not broadcast private data like e-mail or IP address outside of the server your account is hosted on. Our software is built on the reasonable assumption that third party servers cannot be trusted. For example, we cache and reprocess images and videos for you to view, so that the originating server cannot get your IP address, browser name, or time of access. A server you are not signed up with and logged into cannot get your private data or track you across the web. What it can get are your public profile and public posts, which are publicly accessible.
Using Arc on Mac; does the same.
I don't know if it's a plugin I installed or maybe it's default behavior, but if you have the picture icon to the immediate left of the comment counter, you can click on it to expand the photo without having to go into the post.