But can also choose username, so can bypass blacklist.

I think I recall getting around this by hard-configuring the allowed players list?

I never felt the need to work hard to disconnect from Minecraft's auth servers - but I think I remember doing some command line foo once when the Minecraft auth servers were down for a day, in order to let current players keep playing.

Anyway, all that to say, I think are ways to work around that. It's not ideal, but probably manageable.

Disclaimer: I host Luanti now, instead, so I don't remember all of my Minecraft-foo.