Pub Sub with fully server side authentification

Yes

As “app access tokens” don’t represent a user. And you need authorization from the broadcaster to read their data.

Any API endpoint (and thus a PubSub topic) that requires a scope, will generally require a user access token, (such as the subscribers endpoint)

Moderators still need permission from the broadcaster to read the subscriber data.

If you refer to the moderation topic see also

wrt to the changes to the moderator topic