Yes and no.

let’s say I have a website that hosts user generated content like a forum or something. Some other person just hosts a mirror of my website that is not under my control. If some user requests me to delete his data, I can do that. i cannot delete the data from the mirror site.

Nothing else is happening in the fediverse. The only difference is, that in the fediverse the license and technology is set up to encourage mirroring content.

Ieft leaning? These orgs sound more like the typical liberal right centrist orgs from america lol

You just measure the time until the delivery recipe arrives. You can approximate how far away the recipient is. Now you keep doing that while changing your own location (use vpns etc.) and you can slowly get a more accurate location of the target. Now you automate that stuff and also utilize machine learning to interpret the data.

This type of attack theoretically also works with signal or telegram or whatever message service that works entirely without a phone number.

Why would you use first party messaging apps? Who the hell still sends sms? Just use signal. Easy fix.