they could do similar to another platform had done, which is tie voting to a shadow account that only the instance admin team can link to a user, this allows for moderation while providing the ability for obscurity.

I still disagree it should be public in the first place, but I know it's a hard requirement for federation so it's unlikely to become more concealed

Yeah, that's fair enough, though I'm not sure it's very different from malicious instances creating normal user accounts?

You can see when users from an instance are all suspiciously voting the same way at the same time regardless of whether they are usernames or IDs.

There's lots of legitimate users that only vote but never post so doing it based on that doesn't seem very effective?

The second problem is solved using public key cryptography, the same way that you can't impersonate someone else's username to post comments. Votes and comments are digitally signed (There would need to be a different public key for voting to maintain pseudonymity though).