If you enable follow requests, and trust the admins of your followers, does that work as a privacy feature? From what I know, such posts do not get federated to unrelated servers, right?
I was under the impression that boosting follower only posts does not work (via the API too, actually, it returns a HTTP error code if you try to do so), but then again the server code may be modified, or people can just screenshot.
I think this is simply a social problem — when sending a post to your followers, you have to trust that they do not share your post. The same applies in private messaging. You have to trust the recipients.
I agree with you when it comes to private messages, and anyone sharing those is a jerk.
I don't agree in this case where the system is designed to spread those posts. Fair enough if you don't want that to happen, in which case don't use a federated system where that is a design goal.