Ahh here we go: it's a user made setting not a bluesky one
"Sign-in Required This user has requested that their content only be shown to signed-in users. This label was applied by the author."
Why would a user choose to enable that? Would that make it less likely to be scraped by a bot?