Things are already like that somewhat, as far as I can see.
Smaller instances for the most part need to have registration signups or capcha as a minimum, otherwise they risk swift defederation from larger instances when spammers arrive
As lemmy’s mod tools improve I see things moving away from this approach though