I run one of the drand nodes. Yes, the membership is limited. If someone wanted to join they can by just asking and committing to run a node for the long term. It is not a permissionless system, and so Sybill attacks are not in the threat model.