This is an excellent question that I’ve also had. I think (don’t quote me on this) that it’s hosted on whatever instance the community is based out of.

My understanding is that you’ve got essentially 3 different groups of things in lemmy. Users, communities, and posts/comments. Users are authenticated based on their home instance. Communities are stored on their home instance. Comments are stored in their associated community. When you post to a community on another instance, your post is transmitted to the other instance where it’s stored. The reason (generally) that porn is banned on most lemmy instances is because the maintainer of that instance doesn’t want the headache of having to moderate that content which is stored on their server. In the case of a federated instance though while the content might be cached on the server it isn’t technically stored there so I don’t think it runs into the same problems.

Now, what I don’t know about, and someone who knows more about how the federation works hopefully does, is if the owner of an instance would ban federation with an instance hosting porn. Technically I think the owner of an instance can ban federation with any other instance, but I’m not sure they would go that far. I think it might depend on how good a job the other instance does of moderating their content. E.G. if as I suggested PornHub ran their own instance I don’t think most instances would be opposed to federating with it because presumably PornHub already does a good job of policing NSFW content they host. On the other hand if you found some sketchy instance that was hosting lets call it legally dubious content, the instance owner might just ban federation with that instance, in which case I think it’s communities would become inaccessible to you from your home instance. Of course you could make an account on that other instance and just sign in there, but that’s kind of a PITA.

If your an expert on any of this and see somewhere I’ve got this wrong please correct me.