Very interesting, I think I'll probably be using Tor for my Lemmy usage from now on, or at least a VPN since this does have the potential to be used maliciously in personal DDoS attacks.
Are you sure about that because I can open and view lemmy.world just fine in Tor, I think what they mean is federation between hidden services i.e. lemmyinstanceoniondomain.onion is blocked or just not implemented.
I haven't gotten Cloudflare captchas on lemmy.world yet, Haven't tried using an app with Tor, as a general rule it's best to use Tor through the browser since it has features to reduce fingerprinting and MITMs