Which is frustrating! Because it might seem like that's a low enough frequency to make whitelisting a viable solution. But it's not—for the reasons you outlined.
2 calls a month are important enough to me that I must receive every spam call that comes in. I'm still pretty good at sniffing out most of them. A lot are still matching my area-code and exchange numbers on the spoofed ID—a huge red flag. Many others show rural cities that I'm certain no legit caller would call me from. But then there are the in-betweens: calls I can't make heads or tails of unless I answer.
Whenever I do get one of these legit-but-unrecognized calls, I immediately add them to my contacts in some vain attempt to reach whitelist nirvana. But I don't think I'll ever get there.