Indeed, it’s not really a good idea to run your own instance if you’re not prepared to deal with such content. Many small instance admins have shutdown their instances for this very reason.

There was a patch merged recently which disabled caching of federated images, but I believe it still needs some work. Some discussion around that over here: https://sh.itjust.works/post/3962112 including an interesting comment suggesting rerouting /pictrs/ path to 404, so nginx won’t serve any images.