Apparently all that data is included in the ActivityPub protocol. On Kbin, every post has an Activity button that shows every user (even those on other instances) that upvoted/downvoted/saved that post. So if a Lemmy post happens to federate to Kbin, all that info can be seen publicly by anyone.