I think they deserve a lot of credit for creating a product that both my mother (definitely not a 'power user') and I (previous email client: Emacs' Gnus) can both be reasonably productive with.
The primary issue in spam filtering is not that we don't have training corpora, it's that spammers are very efficient at finding holes in your system.
One example is when the Hotmail team first enabled keyword filtering. When the spammers found out experimentally, they began injecting HTML comment tags into high-weighted words like "free", breaking the model. When the Hotmail team took steps to combat this problem, the amount of spam that employed this technique dropped from 5% to close to 0%[1] in a matter of days.
Spam detection is complicated and hard.
[1] Hulten, G., Penta, A., Seshadrinathan, G., and Mishra, M. Trends in spam products and methods.
I've seen this happen where 1 or 2 messages hit my inbox, but the next 20 or so are in my spam folder.
Finding holes on sites like gmail and hotmail is actually much easier than on private sites, because the spammers no doubt have accounts on gmail and hotmail and can test what gets through and what fails and tweak their algorithms until their spam gets through.
Spammers don't have that luxury on private servers, so they have to spam blindly. So in this respect private servers have an advantage over gmail and hotmail.
On the other hand (as has been pointed out many times in this thread), gmail and hotmail have the advantage of advanced spam detection algorithms and virtually instantaneous feedback from millions of users.
Besides, spammers care more about being able to circumvent Gmail's spam filtering than they care about circumventing your own system.
I've run SA professionally for modest (low hundreds) of users. It works reasonably well but it's a job and I'm not paid to do it personally.