They both get several times more spam than the much more recent business-only Google address, yet if their filtering lets through one per month it's a lot. I can't even remember the last false positive.
The majority of the mail that ends up in my Google spambox consists of legitimate email from reputable sources (Amazon, Facebook, Google itself), and barely any actually spam. Extra annoying: perfectly fine email from our own services regularly gets flagged as spam by Google, and we often have no f-ing clue why.
And don't get me started on Google Groups spam filter, which for some reason is even worse. I have to turn it off for any group-address I want to make accessible to non-members.
As an anecdotal example, I have an email address that's been strewn about the internet for almost 2 decades. It's currently hosted on Google Apps, but it has a non-Google domain. I get a spam message in my inbox maybe once every couple of months.
I also have a gmail address. I never use the thing. But it gets inundated with spam, and every month or so when I go look at it I have to clean lots of junk out of the inbox.
Since they're both hosted by Google, I'm forced to conclude that the gmail one gets many orders of magnitude more spam merely by virtue of ending in @gmail.com.
Out of those 100k connections, one or two emails come through to my valid email account. So yes, scattershot makes sense, but from looking at my logs, unless your account includes a lot of numbers you aren't going to get hit :P
And why do people keep making excuses for Google?
Google simply isn't very good at filtering spam, something most regular ISP's can handle perfectly well, and the lack of options in Gmail and Groups clearly show that they don't care very much about it either.
This allows the ESP to curtail spam problems on their end (for example, Mailchimp heavily throttles your emails or outright bans you if your spam rate creeps past a very low percentage). It's an all-around good thing for the ecosystem, with the exception perhaps of publishers that get the unlucky "spam instead of unsubscribe" user action.
But Gmail does not participate in this loop. They don't tell any ESP that a user has marked an email as spam...that data all stays in house. Why? Hell if I know - perhaps they don't want to tip off spammers to being detected. On the flipside, reputable ESPs get less leverage on spammers in their network.