Currently, Lemmy communities appear as group accounts on mastodon which boost every post or comment posted to/in a community. This is effectively useless except for extremely low traffic communities maybe.
It's not clear to me whether this is a Lemmy or Mastodon issue.
Why does it need to be public-facing? There may be solutions that don't require exposing it to billions of people.
Security is always about layers. The more independent layers there are, the fewer the chances someone will break through all of them. There is no one technology that will make your hosting reasonably secure, it's the combination of multiple.
You've already mentioned software ran inside an unprivileged sandbox.
There's also: