From this reddit post:
"Currently all boundary nodes are run by DFINITY (and so far only canisters that would have caused the ic0.app domain to be taken down, such as obvious phishing sites, are being blocked) but there’s ongoing work to decentralize them and allow anyone to run their own boundary nodes, under their own web domain.
That way, if one boundary node operator blocks access to a canister, it can still be accessed via other operators’ boundary nodes. With operators under different legal jurisdictions, it is quite likely that any canister (except egregious offenders, such as child abuse content) will be accessible through one boundary node or other."