Comment by fiatjaf

You have nailed it. Bluesky weirdly tries to omit that as much as they can, but they do admit in their protocol descriptions that everything goes through and depends on a central server with absolute power.

They also mention that anyone can run another of these, but there is zero chance anyone will be able to do that.