Blog post by Christine Lemmer-Webber, co-editor of ActivityPub: https://dustycloud.org/blog/how-decentralized-is-bluesky/
The likely answer to this is that there will always have to be a large corporation at the heart of Bluesky/ATProto, and the network will have to rely on that corporation to do the work of abuse mitigation, particularly in terms of illegal content and spam. This may be a good enough solution for Bluesky’s purposes, but on the economics alone it’s going to be a centralized system that relies on trusting centralized authorities.
Yes, you can self-host it, but the problem is the cost. The blog explains it very clearly.