It's always a cat and mouse game, user+$RANDOM@example.org would still get through and you'd not be able to block that based on the sender (assuming you do it like most people, blacklist-based, rather than allocating new email addresses when you need them).

Of course, this only becomes an issue when the masses start doing it. I'm very surprised how few spammers remove tge +tag, given that that's semi-mainstream by now.

you could track your +labels and reject any unknown ones.

personally i don't worry about spam, i want to track who leaks their users email addresses, and then be able to filter on labels that have gone bad