It (well its predecessor) was an XML based protocol a long time ago, but hasn't been in practice in years. Mastodon, which really popularized ActivityPub, uses JSON-LD. But yes, the ideas of data ownership and identity are just not well specified in ActivityPub. There's work in trying to incorporate capability-based security into ActivityPub but it is a large pain point right now. The protocol also has very varying amounts of uptake. Mastodon and Pleroma mostly implement the ActivityPub server-to-server API and only a handful of ActivityPub implementations support the client-to-server API. I would love to see further work between the Bluesky and AP teams on coming up with a new standard which addresses the flaws in the current protocol.