Images aren’t federated through ActivityPub so I don’t really see how deleting media is supposed to work.
Yes, they are. Every instance downloads everyone’s images for a “cached” version that is currently never used. This is what makes this problem especially insidious and straight up dangerous in cases like CSAM.
The DMA (Digital Markets Act) has clauses that force big companies that are considered “gatekeepers” to allow interoperability with other services.