Blog post by Christine Lemmer-Webber, co-editor of ActivityPub: https://dustycloud.org/blog/how-decentralized-is-bluesky/
The likely answer to this is that there will always have to be a large corporation at the heart of Bluesky/ATProto, and the network will have to rely on that corporation to do the work of abuse mitigation, particularly in terms of illegal content and spam. This may be a good enough solution for Bluesky’s purposes, but on the economics alone it’s going to be a centralized system that relies on trusting centralized authorities.
You can self-host everything, but it doesn’t scale well, and you will likely go bankrupt between 3 - 4 business days.
Of course, partial network relays/appviews are possible to host.