They can. Someone could get your post, then boost it, which distributes it to whoever follows them and so on.
Anyone thinking their post is only seen by their followers when they have federation turned on is grossly misinformed.
Anyone thinking their post is only seen by their followers when they have federation turned on is grossly misinformed.
I think this is simply a social problem — when sending a post to your followers, you have to trust that they do not share your post. The same applies in private messaging. You have to trust the recipients.
I don't agree in this case where the system is designed to spread those posts. Fair enough if you don't want that to happen, in which case don't use a federated system where that is a design goal.