Comments/posts get moderated at the community level, any instance subscribing to it, will also receive the moderation notification to update its cache, so it doesn’t need to be moderated again. In theory, an instance “could” ignore moderation actions for a community it’s subscribed to, but that makes little sense.
A problem comes when a community decides not to remove a comment/post, then it gets spread to all instances that subscribe to that community. Only in that case federated instances need to apply additional moderation.
Federated instances subscribed to a community would have the option to either block the user, the comment, the post, the community, or the whole instance (defederate). Fine grained options like blocking a single user’s every comment on a post, or on a community, or on an instance… or blocking every post by any user from an instance that they send to a community, or… etc. would be additional options… but Lemmy is lacking most of them.
So moderation isn’t inhrently an exponential problem, but right now is limited to a blunt tool that mostly relies on the good faith of everyone for things to work… and it’s been shown over and over that there are people acting in bad faith.