Active users does not say how active. E.g. your active users could be less and less, but if 10% leave and the remaining 90% increase their activity by 20%, you end up with an 8% overall increase.

And in winter people stay inside more, so with all these metrics we should probably adjust for seasons.

Most lemmy.ml users and communities are perfectly fine. I didnt notice a higher number of problematic users from ml than from other instances mine is federated to. I think hexbear and lemmygrad and a bunch of nazi instances are defederated.