Blog post by Christine Lemmer-Webber, co-editor of ActivityPub: https://dustycloud.org/blog/how-decentralized-is-bluesky/
The likely answer to this is that there will always have to be a large corporation at the heart of Bluesky/ATProto, and the network will have to rely on that corporation to do the work of abuse mitigation, particularly in terms of illegal content and spam. This may be a good enough solution for Bluesky’s purposes, but on the economics alone it’s going to be a centralized system that relies on trusting centralized authorities.
Along the lists (for blocking and following), spreading the Bluesky behaviour towards trolls (don't engage, just report and block) would do wonders... Maybe going as far as what old forums did and punish those who keep feeding the trolls.