“Without trying, I found someone’s private Club MacStories feed, which gave me full access to their content.”
Bluesky’s open data model publishes everything by default, including the private feed URLs you paste into a reader app. Paywalled feeds, Patreon feeds, all sitting in plain view. The apps don’t warn you. “Decentralized” turns out to mean nobody is responsible for telling you what leaks.