fuchsiaaaaaaaaaaaaaaaaafucked up that anyone can get an rss feed for your profile, even when it's locked and you don't accept them as a follower.
As an instance admin you can have your reverse proxy server serve a different file on a specific path (that's how my rss rickroll works), or extend that to all profile rss feeds on your instance
nginx config to void rss urls on your instance
location ~ ^/@\w+.rss$ {
return 418; # or anything else, really
}