Have been wondering about this in terms of how safe/secure it may be to use them. Not that a Lemmy account is exactly something to fret a ton over, but I always appreciate a little more peace of mind.
Searching through here I found where Alexandrite’s dev gives a rundown to someone asking in regards to their work, but I didn’t surface similar for others. I’ve tried running some broader searches but haven’t had a ton of luck, so thought I’d ask.
Use 2FA if available. This goes a long way. My instance supports it (TOTP). Not sure if it’s standard across instances.
Jerboa (Lemmy client for Android) also supports it.