Doesn’t federation mean they are potentially possessing copies of that content, hosting it, by being federated?

Media isn’t replicated. Lemmy is a link aggregator, posts include links to content and that is what is replicated. The fact that instances let you upload images directly does make that a bit confusing but if you look at a post from one instance on another the posts link is still the image on the original instance and is fetched from there. The only local media from federated instances are the thumbnails that are generated and stored locally. That’s still a problem in the instance of some illegal content but less so.