It would appear that you assume incorrectly. Instagram will let you dump all your data into a JSON. All Pixelfed is doing is reading that JSON. Pixelfed has no contract with Meta that would block them from reading in that JSON.
As a victim of Meta's Cease and Desists for open-wa, the contract terms is in the Terms of Service that anyone associated with Pixelfed, or anyone associated with the development of Pixelfed has ever accepted regardless if it's a personal or testing account.
In these ToS agreements, Meta believes they can prevent anyone making any tools that they deem break any of their ridiculous terms of service.
I literally had to stop working on my OSS project/tool due to this bullying. Unfortunately I, or other Devs, do not have enough resources to fight this immoral megacorp so therefore they win our compliance.
I think they're using OAuth to connect the accounts, and I believe Meta requires developers click through some agreement to do that.
Edit: I was wrong, see below.
The neat thing is that it unzips the file locally and only uploads the posts you select, which Dansup says helped get around very large instagram archives and also means you don't have to worry about posts you don't want imported being sent to the pixelfed server.