The instance owner determines what’s on their “public” tagged activity feeds. If they remove the “public” tag from a post or user account, it’s restricted from non-authenticated requests from outside servers. You’re correct that this shouldn’t grab user IP addresses, but they could if an instance owner is including that information in what they mark as “public” profile feed data. I should reiterate that I know of no instance that does this, but the capability is there in theory (and I do know that certain forum software packages outside the Fediverse collect and publish this level of information, although it’s a dying practice).

I’m not advocating instance owners turn everything private, but it’s clear they’re going to have to examine what they’re providing through their feeds to Threads if they’re serious about their users’ security and privacy. The safest bet is to defederate from Threads until it’s clear what Meta’s intentions are (aside from their rhetoric, which is always deceitful when it comes to user privacy).

As to what Meta will do, they absolutely will scrape that activity data for marketing use, if they aren’t already. It’s what their entire business model on Facebook is built around - targeted ads based on user activity. Anything they say about protecting that data is lip service at best given their past performances and lawsuits. It also very likely that they’ll merge it with their existing data hoards, and do their best to de-anonymize accounts so that they can increase their data accuracy and thus their profit margin.