Many had and have multiple accounts due to federation shenanigans. The actual userbase might have actually grown despite significantly lower numbers compared to the peak.

My lemmy.world instance used to be painfully slow, but it works perhaps faster than established big social sites now, probably due to the lack of trackers.

I just use the mobile web interface. Good enough for now.

No, because open source apps need to have enough eyes on them to spot malicious code. And highly complex ones need proper audits and even that might not be enough to catch every fancy vulnerability.