If you're running a basic WordPress / CMS - then running Mastodon should be as simple as that (i.e. pay someone to host and run).
If you're running a global website with a load of subdomains, custom features, CDNs, etc - then running Mastodon should be as simple as your existing infrastructure.
Except it's not just spam. Most of the wider fediverse will block your instance if you federate with instances that host nazis, child porn, etc. Which means the first thing you need to do when setting up your instance is gather a list of all those types and block them. Sure, you can say you're committed to "free speech" or whatever, but if all the large servers slam the door in your face your users will have nobody to talk to.
Also, with the way Mastodon works, if your instance federates with another, your instance hosts a cached copy of all of their stuff that appears on your users' timelines. Which means you might run afoul of your host's TOS or even local laws. If you're in Germany and some American nazi's post saying "kill the Jews" gets federated onto your instance, you might be looking at serious legal trouble. Or even if you're not in one of those countries, you might get booted off AWS or Azure for hosting content against their TOS.
So sure, it's as easy enough as any other webapp to launch into your infra, but maintaining a functioning Mastodon instance that doesn't get blocked by the wider fediverse or brings down the wrath of your hosting company or law enforcement on you is hard.
Go to any large instance, hit up their about section and look at their list of banned servers: a good chunk of them have ban reasons like "'free speech' server that federates with gab and other nazis", etc.
What about the tech of Mastadon makes other nodes refuse to "federate with" me if I "federate with" something they don't like?
In practice this basically means that while the fediverse is decentralized and all that cool stuff, it's made up of two main groups of instances ('free speech' ones and not 'free-speech') that don't wanna have anything to do with each other. Self hosting an instance for yourself without blocking anything may work, but the second you open it to the public, questionable people are gonna join and retweet questionable stuff from other instances. If you don't take action you're gonna get blocked, and if you take action you're gonna have to eventually de-federate with these problematic instances yourself.