Never had any trouble with catch-all. Except once in about twenty years have I met a pissed off restaurant owner at my table who thought I'd hacked his website. Only thing I do different since is that I sometimes use `base64@domain.com`.
Now that I think about it: my experience with catch-all is quite the opposite: thanks to catch-all I was able to alert a number of owners their site had been breached.