This is one person. Why would anyone depend on it?

For anything critical, right now, you should not. That is a large part of why the protocol is published and the reference implementation is Apache-2.0.

The failure mode we worry about most is the person who runs this stopping. If that happened tomorrow the spec and a working single-binary server would still be there, and anyone could run them and federate.

That is not a promise the project survives. It does mean its survival does not depend on one person.