and then donate to the instance’s admins because there are no VC’s here … yet.

The point of lemmy (as far as I understand) is that there will not be a central corpo entity controlling and enshittifiying it as a whole, if that does happen to the particular instance your account or community is, you have the freedom to jump to another one, and continue your life.

On the other hand if you enjoy lemmy you could show support/donate, either to the devs, a particular instance admins, or even a particular community moderators

As far as I know, the options are:

• Use a QR reader app that doesn’t auto open links (or lets you configure it like that), so you see the URL and inspect it before opening the URL in the browser.
• In case of a short URL, use a short URL resolver so you can see what is the real destination without actually opening the URL yourself.
• Using a DNS with block lists (that are updated often) of known phishing sites.

If these 3 checks fail, there is not much more you can do.