Except for one thing which has been pointed out by others. Anyone can access *all* of my data over this protocol. I like the idea that a lot of my data is directly accessible similar to the early web. But it would be nice if some of that data was only accessible if the accessor was permitted.
I don't really know much about auth tokens but I'm guessing they shouldn't be that hard to incorporate into this thing? When BlueSky or whatever app queries "@username.com/private/documents" the server expects an auth token, whereas it does not when the app tries accessing "@username.com/bluesky/posts".