If every instance is decentralized, how can you be sure the instance you use is actually running the Mastodon code? How can you be sure it hasn't been modified to collect user credentials, for example?
Is there some sort of signature verification for Mastodon instances?
That said, what "user credentials" would an instance collect? The only people logging into it would be user registered at this instance, "capturing" that makes no sense.
The security model is very much like the one of e-mail: To protect your data, you have to trust your provider, and for communications both the senders and the receivers server have to be trusted to handle the communication contents as expected.
And if you centralize (like to Twitter or Facebook), how do you verify it has the security and/or privacy policies they claim it does?