Seems to me that they _did_ consider those concerns to some extent, but the specification doesn't really address them:

> Unfortunately at the time of standardization, there are no strongly agreed upon mechanisms for authentication. Some possible directions for authentication are laid out in the Social Web Community Group Authentication and Authorization best practices report.

https://www.w3.org/TR/activitypub/#authorization