I've been using Mastodon and it's a pleasant change of pace. I've heard of some spam happening there but I think responsive admins and the lack of algorithmic feeds really reduces their reach.

Fair, though this is also where the double-edge sword of discoverability steps in too. Many people complain about the lack of it on decentralized systems, but centralized systems have a nice catalog of users for bots to message with little effort.

I'll admit that lack of discoverability isn't a perfect solution since there are other ways for spammers to discover users. E-mail is a great example of a large, long running, decentralized system that has increasingly suffered from spam since its inception due to mass data collection of addresses. However if you're really careful about who you share your address with, it's possible to still avoid most of it. I give out unique e-mail address to companies and spam tends to only come in on a few, often because they were breached or are otherwise "leaky" about their user's data. Dropbox is by far the worst offender.

Nah it just means you need to contract with a temp sms number provider. It'll be difficult for your average kid in a garage to run bulk bots but not for state, corporate, and other well funded actors.