Yes. But a bad actor doesn't have to sign up to mastodon.art to harass users there. They can use some pleroma cesspit or their own instance and do it from there.