It's important to note that both Lemmy and kbin are licensed under AGPL, which means that any instance using code based on Lemmy or kbin must publish their full source code. Not even the Lemmy devs can change this.

A number of Lemmy instances that have their own forks have unfortunately not upheld this license, as they only link to the LemmyNet github, not their own code. Nothing against the instance maintainers of course, everything is still very new here.

But yeah, it is possible that a Lemmy or kbin instance pops up that has reimplemented the Lemmy federation from scratch, withuot publishing their source code. Doing that is highly likely to be a form of "Embrace Extend Extinguish", and any instances doing that should be defederated as a matter of policy.

But yeah, the decentralized nature of Lemmy means that if any instances try to do anti-user things, then the users can just vote with their feet and leave, and still have access to all of their communities. The only limitation is that instances effectively control their communities and user accounts, but hopefully that will be improved in the future with user migration features and community federation.