I think you derive your last point about moderation from your lack of experimentation with relay software. The only thing preventing anyone from applying the moderation and/or safety measures they see fit to a relay would be tooling. But there are already plenty of relay software that offer plethora of possibilities. Even on a client level, you can share mute lists. This model is actually more similar to fediverse than most people think, with the fundamental difference that in nostr paradigm, no admin or domain registrar can void your identity and social graph. Being banned from a relay does not imply losing the friends you made on it.
In essence: The protocol is permissionless, relays are not.
