I mean, that just comes down to your vetting process. But also it keeps me out cuz I can't be bothered making an account for every instance that does that.
Is that a me problem? Yeah.
Anyway, the issue ain't the auth req, it's whether you let in any rando that just asks nicely. It's a more tedious version of "just send me a follow request, I'm just keeping out bots". Which is fine, if that's all you're trying to keep out.
