Since there is no hierarchical top general moderator/admin and every instance is under supervision by the respective owners of these instances, responsibility of safety is technically forwarded to individual instance admins as far as their instance goes. Or that's what I make of it at least, anyone feel free to correct me if I'm wrong. Also, the above conclusion does not include any possible random future law made up to state differently (decision-making entities have weird unpredictable logics... 😅)

As far as for Mastodon itself, it could use some upgrades in its user management and reporting features, though (an option to automate instant reactions (like tempban until reviewed) on certain categories of reports (like child abuse and extreme/shocking violence) to prevent anyone reported for those kinds of things actively being able to continue until an admin sees and processes the report and reports are definitely not visible enough yet).