I'm not fully aware of the tech here, are those posts flagged as 'Intolerant' by bsky or by the protocol itself?

By Bluesky.

The protocol has a notion of moderation accounts, sometimes called "labelers" because they can apply labels to your account. Users generally [1] subscribe to the moderation that they want to see. They can then set those labels to make the application to "show", "warn" (collapse by default, click to expand), or "hide" based on the labels.

1: People using the bluesky app cannot unsubscribe from the bluesky moderation service, but that is a policy choice of the bluesky app, not a protocol level choice, other clients can do as they choose.