Except it's not just spam. Most of the wider fediverse will block your instance if you federate with instances that host nazis, child porn, etc. Which means the first thing you need to do when setting up your instance is gather a list of all those types and block them. Sure, you can say you're committed to "free speech" or whatever, but if all the large servers slam the door in your face your users will have nobody to talk to.
Also, with the way Mastodon works, if your instance federates with another, your instance hosts a cached copy of all of their stuff that appears on your users' timelines. Which means you might run afoul of your host's TOS or even local laws. If you're in Germany and some American nazi's post saying "kill the Jews" gets federated onto your instance, you might be looking at serious legal trouble. Or even if you're not in one of those countries, you might get booted off AWS or Azure for hosting content against their TOS.
So sure, it's as easy enough as any other webapp to launch into your infra, but maintaining a functioning Mastodon instance that doesn't get blocked by the wider fediverse or brings down the wrath of your hosting company or law enforcement on you is hard.