Could it be limited to only show the top 3 emoji reactions on the UI (like on LinkedIn), or simply show the number of reactions, and require an extra click to view them all?
Did any of the other instances suffer this vulnerability? Or are they all running different code? i.e. different repositories/implementations of Lemmy