This is basically correct, they could also create a scheme where they charge for federation and introduce it on short notice, similar to what reddit and Twitter did with their api. I think the best way to prevent this is to not federate with corpos, especially when they’ve been bad actors in other ecosystems like fb and Google.