The scrutiny from investors, legal and compliance exists because the risks are real, and they don't go away just because there isn't a Serious Business involved. Once someone operating one of these is publicly damaged, the risk will be better understood and marked up accordingly.
They sure are, which brings back to the point: how much did this implementation of Mastadon adequately addressed these risks with the reduced code count?