The main issue you’re gonna encouter is CORS. There is no real upstream decision on loosening the existing CORS permissions. The alternative is to proxy every request from everyone which will not only get you rate limited but also you will have to deal with storing people’s authentication tokens which requires not only complete trust in every step of the way but also not accidentally messing things up and exposing them somewhere.
Even in the most safe space-y parts of Mastodon (which has way more experience with trolls & assholes than Lemmy just by existing for longer), single user instances don’t get defederated without reason. So I’d be more in favor of reflecting inwards and wondering if there is a specific reason why they defed’d me.