Not in my experience. I'm on a tiny instance and follows are so rare in general, I can watch them all individually.
There are many users that require follow requests where they verify/vet every single follow.
> It's probably also not that hard to make something that easily passes those sorts of quick checks?
Maybe such that one person doesn't notice, but remember the scale here: if someone is trying to "follow the world" maliciously, they have to make sure that they pass the quick checks of every paranoid person they try to follow. Once a malicious site is "discovered" the #fediblock hash tag moves pretty virally to encourage other paranoid users/instances to (re-)evaluate the bad actor.
> Which then means anything of yours that gets boosted by someone on a server like that will be indexed
(Courteous) Instances don't allow you to boost a Followers Only post to the Public timeline.
Discourteous instances may exist, but when they are found out, they are generally blocked (again, the #fediblock hashtag sometimes moves swiftly and virally here).
That's rare, though, right? Since there's often a ton of following going around, especially now?
It's probably also not that hard to make something that easily passes those sorts of quick checks?
> Some instances are fine with search indexing their public timelines.
Which then means anything of yours that gets boosted by someone on a server like that will be indexed.