Key point: if your platform allows people to post links that Google can see Spammers will inevitably try to take advantage of your website
I mostly use "rel=nofollow noopener noreferrer" which should cover most "use-cases" of spammers.
> rel="ugc"
> We recommend marking user-generated content (UGC) links, such as comments and forum posts, with the ugc value.
It takes less faf for them to just post anyway than to check if you use nofollow/other, and they may still get a small side benefit if a blog-spam scraper or such takes your content and reposts it without the extra directives.
Maybe to you. But you are not the only person in the world. And as the other comment said, spam still gets exposure to other comment readers.
Either way, the spammer rarely spams his own thing. They spam what someone else pays them to spam, and don't care if it actually works as long as their customer believes it works (much like legal advertising).
Although not sure how much it's respected
Spammers don't bother checking existing links at their target site since indescriminate spamming at scale obviously works and doesn't need such finese.