Malicious instances would need to be blocked by the instance you are registered to.
As for multiple accounts - couldn’t the same thing be done on reddit? Just make a bunch of alts and self-inflate your own posts/comments.
These issues are as old as the internet and can only be mitigated, not prevented.
Huh - I had not even considered downvotes in other instances… Yeah that seems problematic. Maybe rather than defederating downvotes, there could be a way to differentiate between local and global up/downvotes.