Just replace "Lemmy instance" with "blog", and the answer is obvious.
"consider a Mexican user visiting a blog located in Germany to view Nazi content."
The user is subject to Mexican laws. The blog owner would be subject to German laws. The instance owner is likewise subject to German laws.
Adding additional parties doesn't change anything. For example, if a Mexican user on a Swiss VPN views content originating from a blog in Germany, then the user, the VPN, and the blog are all subject to laws of their own jurisdiction.
Those laws can regulate what content you can access, what content you can host, or both.
If you are American then your Lemmy instance is most likely be protected by section 230, and you probably don't have to worry too much about non-pirated content. If you live in another country or host pirated content in the US, then YMMV.