That is true. I think spam lists usually have many thousands of addresses though, so unless they’re doing it with a script, they’re probably not stripping the subaddresses.

But a service that lets you use a dash instead of a plus, like Port87, is a bit safer in that regard. The dash is also accepted everywhere, whereas some places (like Microsoft) don’t accept a plus in an email address.