In my experience, spam blacklists have significantly decreased in efficiency over the last 10 years. I think the biggest e-mail providers stopped contributing to them, so the user-reported lists are almost unused. The honeypot lists lag behind the spammers by a few days, so plenty slip through. They do trim out 85% of my incoming spam, but that last 15% is still a lot. Back in ~2013 they cut out more like 99%.

Today, the single most effective thing you can do if you run your own mail server is to completely block all gTLDs. Screw 'em, they are 99.9999% spam.

Plenty of spam has valid SPF and DKIM records. They are sent through legit services, either through cracked credentials of real users or rotating through new accounts.

It also doesn't seem like anybody cares about abuse@/spam@ reports anymore...