The article discusses this, a bit. One of the other platforms is considering an enhancement to require request signatures on non-ActivityPub APIs, I.E. Meta can make unsigned requests, where the server doesn’t know who they’re from, but only get minimal (or no) data back, or Meta can make signed requests, and instance owners get to decide what data (if any) they’re okay with sharing to Meta, based on Meta’s privacy policies. Beyond API’s, you’re talking about web scraping, which is something the industry has been handling for decades.