Agreed, though i do think it's a privacy thing. Many people use privacy and anonymity interchangeably but they are different things.

The options are:

• use a single email. If it is leaked you need to update hundreds of accounts or risk falling for a malicious email
• use a catch-all email and each service gets a separate email, but you can't turn off receiving mail at a specific address unless you use a sieve filter. This doesn't stop people from just guessing random addresses.
• use specific aliases for each service. Idk about this specific project but usually you can turn off receiving mail at an alias. So if a company gets a data breach i just change my email (or close the acct), then i turn off the old alias.

I did the catchall for a few years but have been doing aliases for 5+ now. In the end, the only people/ companies who have my email are the ones I want.

Does it?

Do you think spammer will just stop at the first address and then call it a day?

In my experience there is no such thing as a "catch all" domain address. The second your domain leaks then many spammer will just go into a frenzy and try hundreds or thousands of mail aliases.

Especially since they can't really spam Gmail as easily (since early 2024) they will even more aggressively spam any other domain.