I've got my email out there on my HN profile, and others. All using a unique alias to the same mailbox. None of those alises where I'm using at instead of @ have received emails.

I can only conclude spam bots aren't that good.

I'm surprised at how few spammers have stolen my non-GMail address from my public GitHub commits or my one AUR package. I've gotten one scam email within the last month, and none I can remember for the past few years before that.

I'll bet spammers assume anyone cautious enough to do the absolute minimum to obscure their email is too hard a target for anything but a higher-investment phishing attempt. The same reason they purposefully include spelling errors in bogus official emails; to get their targets to self-select.