That's because Reddit chose to leave it up until the media reported on it, though.

That said, it's really hard to protect against a dedicated, targeted attack. Eg, stuff like captchas can make it harder to create accounts, but think about how fast you could make accounts manually if you wanted to. You don't need thousands of accounts to cause mayhem. Even a few dozen can cause serious problems. I think a lot of the internet depends on the general good will of most users. Plus the threat of legal action if they get caught (but that basically requires depending on police and we know police aren't dependable).

One thing Reddit had that I'm not sure Lemmy does (never heard mentions of it) is the option to require all posts and comments to be approved by a mod before it's visible. That might even have just been an automod thing combined with how Reddit let admins hide and unhide comments. But even if they were to use that, it's not fair for volunteer mode to have to deal with that. It's also sooo much work. You can't just approve posts, cause attackers will use comments. And you have to approve edits or attackers will post something innocent and then edit it to be malicious. And even without an edit, they can link to an image and then change the file itself to a different one (checksums could prevent that, but it's more work and it's a constant battle against malice).