Should this apply to the outbox as well? cc @kopper

Unsure, people may want to block post lists reasons but still allow the outbox given it's behind authorized fetch (though it only really matters for allow-list instances given how easy it is to spin up something to scrape outboxes otherwise).

It could be a separate setting altogether, but I'm worried that may just confuse people.

Yeah, that makes sense, thank you!