I don’t care so much if my personal info is posted to a website like kiwifarms or someone’s private blog, because those websites are harder to find in search results

So is most of Lemmy

Big companies have a desire to protect themselves from prosecution for hosting illegal activity.

So do Lemmy instance hosters, the hosting companies they use, and the other instances which federate with them.

They specifically hire people to moderate content and reduce their liability.

Once can expect lemmy instances to do this once they reach a certain size. If you don't moderate sufficiently, you get de-federated, and your users won't want to use your instance, so lemmy instances which want to grow will keep a handle on good moderation,

But she can run a Lemmy instance that will federate with the entire rest of the fediverse and expose her content to potentially thousands of people.

If she posts it to a lemmy community the mod that community or instance will remove it. If she hosts her own instance for the purposes of doxxing people nobody will even see the post (since it's not getting upvoted across fedi) and other instances will de-federate.

Ultimately, if you are at high risk of doxxing, the best measures to protect yourself are mostly based not around which platforms you trust or not, but around engaging with those platforms in a way which protects your privacy. Might want to check out the surveillance self-defense guide. https://ssd.eff.org/