The problem is that he added a secret, undocumented list that was only added when you were running the program that only he maintained.

If you were on an affected server, it gave an incompatible server message. If you were an affected user, it just hid you completely.

He went to extreme lengths to try and avoid this being discovered.

He seriously compromised the fundamental nature and trust of the entire activitypub project sphere.