The user has to be shown the follow request to approve, right?

So now your user's incoming follow request inbox is a list of viagra ads, .eth scams, and pornstars.

Ah... The "good old days" of poor spam filtering

Since this is federated, you're not limited to "mastodon settings". You can choose to simply ignore follow requests fully, or to not show them to the user, or whatever else you wish.

I.e., implement spam blocking measures.

No, just ignore aspects that are prone to spam and bring little value.

Follow requests are a relatively weak spam vector: you have a tiny 32x32 avatar and an "email address" format username. Maybe you hope people visit your profile page from there but no one sees it by default in their follow request list. If you try to put spam content in the avatar or username people automatically block you. If you don't and hope on someone glancing at your profile, a lot of people ignore follow requests from unknown/unexpected usernames by habit. If you try to put the spam in your domain name people automatically block your entire instance.

Ie, servers have to do spam blocking.

No one is arguing that spam blocking isn't a part of instance moderation.

I'm saying that in terms of economic "bang for the buck", if you were going to spam the fediverse doing it with follow requests is a terrible way to do it with very low likelihood of success. You are better off trying for other means of virally distributing toots than follow request spam.

My intent was not to identify a viable channel for spamming the fediverse, but more to point out that permitting messages from random new nodes happens in at least one standard interaction on an activitypub server - an ‘existence proof’ of a sort for a message channel that doesn’t get solved by follow-based whitelisting.

Economics effects still apply to spam. Low useful signal still is an economic factor on if it is worth to do follow request spam "at scale" or not.

Also, federation itself may be allowlist-based. Some instances already run that way. Likely many more would if inter-instance spam follow requests rose above a certain threshold.