EDIT: This bug report might have been made in error, so it can be closed. I will make a new bug report if this is actually an issue.
I see two issues here. First of all, they should not be able to join a private (Friends+ instance with no mutual friends) instance. And secondly, they should not have moderation powers in a private (instance type is not public and they are not instance creator) instance.
Self moderation should mean that I can block people and not have them join my private instances. Doesn't matter if they are the ones that uploaded the world, and it shouldn't matter if the world is set to private.
Steps to Reproduce
  1. Player B uploads world as private
  2. Player B gives world website link to Player A
  3. Player A blocks and unfriends Players B
  4. Player A creates a Friends+ instance of the world
  5. Player B is able to join the Friends+ instance (should not be able to, unless mutual friend is there)
  6. Player B can kick Player A (they should not have moderation power in a private instance)