The best part of the fediverse is that anyone can run their own server. The downside of this is that anyone can easily create hordes of fake accounts, as I will now demonstrate.
Fighting fake accounts is hard and most implementations do not currently have an effective way of filtering out fake accounts. I’m sure that the developers will step in if this becomes a bigger problem. Until then, remember that votes are just a number.
Requiring a phone number to sign up for an instance just changes who can sign up on that instance.
ActivityPub can get Likes and Dislikes from any system it is federated with. If someone boosts a post on Mastodon, Lemmy sees that as an upvote. Requiring a phone number on someLemmyInstance to sign up has no impact on who can sign up for Mastodon and boost content there.
It is also trivial to spin up your own instance of an existing application and manipulate it to your heart’s desire.
Lastly, as the protocol is open and its just about pushing some JSON to a server that will accept it, it would be easy to write an application that federates with a server and does nothing more than push votes. Imagine someone writing a Tinder style application where you’re shown a random post from the fediverse and then swipe left or right and then cast that vote.
The fediverse is more like email and Lemmy is one client to access and it has a bunch of mailing lists hosted on it… and there are many others. Requiring a phone number to sign up for Lemmy would have no impact on who can sign up on another mail service and they’re still quite capable of sending email… and you don’t even need a mail client to send email, I can do bulk mail merges from Microsoft Word.
Defederation cuts off a particular instance from sending messages on ActivityPub to that server, but its easy to spin up another server or use an open server (there’s a reason why Email anti spam systems maintain an open relay blacklist - https://en.wikipedia.org/wiki/Spam_and_Open_Relay_Blocking_System ).
Ultimately, the fediverse (and lemmy) is going to need to figure out how to deal with spam - be it votes or posts - just as email and Usenet news have.