The attacker gained access to the admin interface, I'm pretty sure this is also possible with Mastodon. Just you have to gain access to the right server. If someone attacks server A and the actual target is on server B, they are out of luck.
The difference is that you can't compromise the whole federation by compromising a single server the way you can with Twitter.
That was kinda my point. Mastadon has sadly other issues which let me stick with Twitter.
I use both, and I find that I generally prefer Mastodon nowadays. I find it's strictly better, and a lot snappier as well. Meanwhile, the community is now large enough that there's no lack of interesting content.