Johnnyloans Follow-up as promised. The fix is written and submitted:
https://github.com/flarum/framework/pull/4852
It changes the no-JavaScript page to ask for the posts that belong to that page and print exactly those, rather than scanning the whole API response for anything post-shaped. Quoted posts cannot slip in that way.
Looking into it turned up a second problem that is arguably worse than the one you found. Links to a specific post, the /d/1234-some-discussion/56 form, work out which page that post is on and use it for the previous and next links and for the canonical URL, but then print a window of posts centred on the linked post instead. So one of those URLs can tell a search engine "I am page 2" and then show it posts from page 1. On my test forum a link to post 25 announced itself as page 2 and printed posts 15 to 30, when page 2 is posts 21 to 30.
That looks like a good explanation for a Flarum bug that has been open since 2022, where Google was indexing discussion pages using content from other pages. The same change fixes it, because the posts a page prints now always match the page it claims to be.
Both are covered by tests. To be clear about where it stands, it is a pull request under review rather than anything decided, so I cannot promise if or when it is accepted. It targets 1.x, so if it does land, forums on 1.x get it through a normal update with nothing to install.