No idea what sort of security this is supposed to provide.
They probably see it as some sort of security / anti-spam mechanism.
My emails have a tendency to become spam filter bycatch, to the point that when I was job hunting last year I'd have to ring people after I sent them my resumes etc. to confirm they actually received my email.
And when I give people my email address, I usually have to assure them that steve@stevetech.xyz is a legitimate email address and not a joke (it's not actually steve, but you get the point).
Definitely would not recommend using it for your personal address.
If he said he used "joe@company.example.com", then it's possible he has a wildcard MX record for *.example.com, but that's not at all what he said, although perhaps it's what he meant.
Regardless, the question remains unanswered.
The one exception is Craigslist; if I email someone with my normal email, I never get a response. I always use gmail for that.
I also use greg-*@domain instead of *@domain, since their docs claim that setting up *@domain tends to attract more spam.
It's not cheap from PM, and there are loads of hosting providers that will provide catch-all email for free with your hosting package (but with some usually pretty poor webmail client) or if you use a mail client it should work too.
I like having good webmail and mail app and other things so I pay, but there are plenty of good options available. Sadly self-hosting email server is not really an option for a variety of reasons, but you should easily be able to use catch-all e-mail addresses.
At some point, I need to migrate away from google and build out my own personal mail server.
It's a freemium model, but I've never needed anything in the paid tier