there are no protections against creating multiple accounts to upvote your own posts
They don’t even have to be real accounts. Lemmy uses the ActivityPub protocol, and nothing’s stopping someone from creating an ActivityPub server that federates with a Lemmy instance and spams upvotes from randomly-generated usernames. The server could just pretend that every username is a valid one.
Of course, I think something like that would be defederated pretty quickly.