@ghost_bird I think that's the difference authorized fetch makes possible, see https://docs.joinmastodon.org/admin/config/#authorized_fetch
where with authorized fetch everything has to ask back to the original server to see if it's allowed