Apparently all that data is included in the ActivityPub protocol. On Kbin, every post has an Activity button that shows every user (even those on other instances) that upvoted/downvoted/saved that post. So if a Lemmy post happens to federate to Kbin, all that info can be seen publicly by anyone.
Somewhat related, I’m so annoyed that my USB 3.0 SATA adapter doesn’t pass S.M.A.R.T. data. Didn’t even think to check for such a deficiency. Just another thing to watch out for when buying these adapters.