How could one "control" a federation protocol though?

Consider how worried people are about Google Chrome's browser market share, and how Google is increasingly able to dictate details of the web unilaterally. The Web is made of standardized protocols, but Google has significant control over it.

Consider the state of email, a standardized protocol, where Gmail is dominant, and anything that can't deliver to Gmail is practically irrelevant, no matter whether it follows the protocol.

Now consider Bluesky. If Twitter supports the AT protocol early, it would be by far the largest implementation, meaning that Twitter practically controls it. It would be like Gmail for email, except there are no other options to begin with. If Twitter does not support AT protocol early, then AT protocol will be irrelevant, and other networks like the ActivityPub Fediverse will continue to outpace it.

By being the gatekeeper of its evolution of course.

that's an interesting question, I think spam is part of how... for a proper answer I would look at how SMTP has evolved over time.

SMTP started without proper authentication so anyone could spoof anyone's address. Most of those extensions try to fix this. But ActivityPub, for example, has authentication built-in from the beginning in the form of HTTP signatures.