Woha, this is unexpected: in a future update mastodon will automatically turn off open registration if no mod has logged in for a week or longer:
https://github.com/mastodon/mastodon/pull/29318
This is great news, and should hopefully significantly cut down on abandoned servers being used to send spam!
(And this is in addition to also having open registrations off by default on new servers.)
Great news!