Before we get into the weeds here, let's start with an important basic premise: Moderation ability, at a protocol level, from an instance/relay admin perspective in nostr and AP is identical.
Are there moderation tools to propagate bans across relays quickly?
Relay operators can share ban lists like they do in AP. Relay operators can only directly control their own relay, not other relays. I don't know the ins-and-outs of how the interface on the admin side looks, but at a protocol level, AP and Nostr offer the same abilities.
Some users need to be booted off the network entirely and swiftly sometimes, we’ve seen several cases of this in Lemmy already with users posting horrendous shit. I’d be concerned that one of my relays would lag on banning (timezone differences for moderators or whatever innocuous reason) and these users achieve their goal of more people seeing the shit they post. For some people this might trigger PTSD, which is why I say it would be a huge barrier to mass adoption until that issue is resolved.
Relays sharing ban lists help can solve this problem. I would argue that we don't want to give that power (to ban a user from the entire network) to a single relay admin or even a couple relay admins (since anybody can be a relay admin), so broad consensus of some form needs to exist OR sets of relays can form their own little networks of trust where they will automatically trust a ban from other admins in that network. A relay admin doesn't need to be able to ban somebody from the entire network if they simply disagree with that user's post, they can just ban the user on their own relay. There is value in having public squares with varying degrees of moderation, among other reasons, because laws about what kind of speech are acceptable vary country by country. There is value in having mainstream platforms which refuse to host some kinds of content and having that be a different moderation policy than the one used by the government, for example. Remember that legality and morality are not the same and that there are differences in what is illegal vs illegal in different jurisdictions. We don't want the legal standards of Russia or China to the legal standards the entire network has to follow.
If the user is doing something which is very illegal, which I believe you are referring to, that is a job for law enforcement. Neutral networks like the internet are traditionally policed "at the edges". We don't have gmail proactively filtering for objectionable or illegal content because of the consequences that come from that privacy invasion, false positives, additional computational load, reducing reliability of sending/receive between email carriers, etc. Comcast is not inspecting packets as they fly through their network at a the speed of light, delaying them, and determining if they should be passed or not. It's the internet, they just pass them through. Instead, we say "this is an open, neutral network and if you break the law, LEO will deal with it".