The thing is you don't want to completely blackhole/delete messages received at a valid randomly-generated address, but which were sent by an unexpected sender. For that, I have a separate "Suspicious" child of my main "Inbox". The main exception I've seen that falls under "Suspicious" is that Amazon shares your account's email address with their shippers; so you'll receive a Fedex delivery notification at your Amazon address, which falls under "Suspicious" because the sender address doesn't originate from Amazon.

What I find mildly strange is that, in the 2 years since I've migrated from Gmail to a super-organized and rules-based organization with Fastmail, I have literally not received a single spam email. I credit this to having migrated my GitHub account to use their privacy wrapper, so none of my commits have a personal email attached to them. I thus suspect that most developers who receive spam have had their email crawled from commits to public Git repositories.

Of course, there is a caveat: I do not expect to be able to maintain this kind of scheme into old age. There's no way, at 60-70-80-90 years of age, that I will still be mentally capable of managing a wildcard domain. So while it works for now... at some point I will need to simplify back to a single email address. Sigh... fml in advance. :(