My guess is pedophiles are going to discover Lemmy at some point and spam it with child porn

That already happened. Just not with child pornography AFAIK, but with gore, nudity and ads. That’s why many instances have an application process: to keep the bots and trolls out.