if you use the name+tag@gmail.com trick to tag the business or website where your are using that email
can't a scraper remove all +tag portions using a regex and send spam email directly to plain email address
you won't know the source of the leak if that happens
businesses can themselves do this if they deliberately want to sell or misuse your info
I usually go about this now by having a dedicated domain for only EMail with a catch-all configured (Fastmail, Protonmail at least for Pro users allow this). That's great because everytime I'm required to provide an email for no reason at all for example hotel checkins i can just come up with a new one on the fly: hotelname2020@example.com
Bonus points for also preventing credential stuffing in case they get their badly secured passwords compromised too.
I don't have the numbers to back this up right now, but 90% of my spam comes from scraping my email from public documents, Github or one-off webshop purchases.