Depends if the rate of creation of the suspicious instances is higher than the mods can manage.

Two solutions that I see:

1. Mods and/or admins need to be notified when a post has a lot of upvotes from accounts on the same instance.
2. Generalize whitelists and requests to federate from new instances.

Well the “federated” feed is similar to /r/all, that’s a useful feature imo. The local feed has no equivalent because it relies on the concept of instance.