I actually expect most Masto and PixelFed instances will block Tumblr pretty fast.
There are two routes we could take to fix this. One is building social pressure and a social consciousness around federation. The other is to bribe people, like how crypto social media rewards people for making popular posts.
Does the protocol come with inherently good way to deal with spam right in the core design? If not, it’ll eventually end with delegating trust to corporations.
It's a good analogy on a couple of levels, because of course Gmail has become a dominant player in that space, in some occasionally problematic ways (e.g. it's very difficult to run your own email server now, because GMail might decide you're not trustworthy and stop delivering your mail). There are still several big players though and the system works.
Personally, I wouldn't see it because my main timeline is "following only" (I also have a "followers + replies they make" view for finding new content.) Also I'd be able to remove it because I control my server. Also also I could write a Pleroma filter which says "if it's a post to me and I've not seen that instance before, hide it".
Reply spam still works, but that doesn't scale as easily.
When competent spammers start looking at Mastodon, either we hope buying domains is too expensive to be worth it (unlike email spam), or rely on IP range bans.
People will gravitate towards whatever is easiest unless incentivized to do otherwise. Usually incentives are either social or financial and interestingly both are being attempted currently.
The left-leaning folks are trying the social pressure route. One of the themes of the modern left is trying to change culture in order to pressure people into doing the right thing. You can see this right now with the vitriol against Elon Musk on twitter. This vitriol creates social pressure.
The libertarian-minded folks are attempting the financial route. One way of viewing crypto is as a tool to bribe people away from traditional institutions. Crypto wallets are essentially bribing people to install cryptographic tools onto their devices. De-fi is trying to lure people away from traditional financial institutions.
How you judge either movement is up to you. I’m just saying what I’ve observed. It’s also worth noting that each movement is creating copies of traditional web apps. There is a crypto version of reddit and a federated version of reddit for example.