I also think that the kind of hoops tech-savvy folks go through to protect their main email account from spam are more time and effort than dealing with spam in the first place.
I'm personally not going to register for things with a thousand different + addresses just to try and find out what company leaked my email. Even if I manage that with a password manager it just seems like an extra chore.
Spammer's got me email address? I don't really care. The spam is going to the spam box.
Am I opening myself up to a larger attack vector? I guess so, maybe. There are more important things in life than locking down my online life like it's fort knox.
Like, think about it, OP. You got a piece of spam mail and you contacted Amazon, and then made a post on HN about it. Is this really worth your time and headspace? I get hundreds of pieces of spam email a month and I don't notice or care.
I don't really think email addresses were designed to be private pieces of information in the first place. Enabling two-factor authentication is the effective protection against account seizure.