What's stopping websites from just removing '+company' from 'username+company@gmail.com' and emailing you at 'username@gmail.com'?
Even if the website you provide it to doesn't do that. Anyone who buys it can.
I'm guessing the answer is, "Most companies are too lazy", but that seems like a weak behavior to depend on.