I can imagine that spammers nowadays can write a simple script that drops everything from the + to the @, so while that may work for some spammers, others will just use your normal email address. I’ve resorted to creating a catchall for my personal domain. Also not ideal, but it’ll hopefully take them a while to figure that one out for everyone using their own domain.