I think you’re mistaken in your assumption it would be easy to identify malicious instances. Bots are notoriously difficult to fight, every time you block one method another workaround will appear.

I run a large instance and I look around in the DB occasionally when users complain, so I'm pretty familiar with what's in there.

A whitelist defeats the decentralisation and openness of a defederated system.

True, but assholes are assholes and sometimes freedom and assholery don't mix well.