Regardless of the technical measures, I think we can all agree something called 'Mastodon' will be safe from spam bots in perpetuity simply by virtue of not having any non-geek users.

"Hey Melissa, here's my Mastodon handle, hit me up."

"Your... what?"

"My Mastodon, it's a federated social network free from any corporate overlord!"

"Whatever, freak..."