

FWIW, at this point, that study would be horribly outdated. It was done in 2022, which means it probably took place in early 2022 or 2021. The models used for coding have come a long way since then, the study would essentially have to be redone on current models to see if that’s still the case.
The people’s perceptions have probably not changed, but if the code is actually insecure would need to be reassessed
If a user is banned on their home instance, that ban is federated out to all instances. If a user is banned on a remote instance, they’re just banned locally on that instance, and their account remains active for all other instances.
They’re likely some remote users who have interacted enough with your instance to be federated over, and then banned on their home instance.