Unfortunatly its a cost we must accept since the justification makes it worth it.
That’s for the user to decide. The devs should not presume to make it on the users’ behalf.
It’s not entirely clear, but it appears to be up to the instance operator.
Users can disable referer headers in their browser settings which overrides anything the instance operators can do.