Surely that would be possible with Authorised Fetch, yet nobody mentions the possibility.

Not really (in practice, anyway). Authorized fetch without cooperation from the remote instance only works on a per-instance basis. If you have a mutual from an instance then every follower from that instance would see your theoratical "mutuals only" post, if the only access control you have is authorized fetch.

There are some people working on circles and other ways of limiting visibility more granularly than what we have, but those will have to be supported by both ends. You may be able to hack together a gigantic mentions only thread with double digits of people on there without modifying server code too much, but the UX there would be terrible enough for that to not be viable (and certain anti-spam functionality like hellthread MRFs may end up kicking in which prevent that from federating to instances that have those enabled (especially after the recent Japanese spam attacks))