@evan I would tend to say "Both", but I am saying Alice.
Mastodon (not ActivityPub) specifically lacks level of privacy "local". Therefore I use the "followers only" mode to run moderator's account, which confirm follow requests only to local accounts. I want this discussion restricted only to followers, but actually, I wouldn't mind, if I could restrict the privacy to "local users" (some other ActivityPub implementations allow this). But I guess some users in followers-only mode have the same need for privacy.
On the other hand, if there can be more privacy level, there would be very useful level of both status privacy level and reply allowance mode, which would be "people, who I follow only". This would effectively allow me to mix functionality of "anybody can follow" accounts with "confirmation of follow requests": simply, all people, who I follow, would be considered friends and would be considered my inner circle. No need for blocking - just unfollowing someone would remove them.
Adding privacy level "people, who I follow" privacy level besides existing "followers only" and using this also to determine who can reply, would make things much easier, at least for me.
I want to keep open follow policy, but there are certain topics, which I don't really want to discuss openly with general public. But the fact, that I follow someone, usually means, that there are some common interests. If they don't follow me back - well, it is their fault, who cares. Technically, I see zero implementation difference if I compare "who I follow" to "who follows me". These two are very similar SQL queries. But it would be "5th level of privacy" (local users are 6th level).
But there can be different privacy preferences and maybe, some people may like to use lists also as "target groups" (called Circles on Googe Plus)... but this would be probably very hard to implement in federated environment.