1. The bayesian filter updates only when you actually delete emails from the Spam folder.
2. There is a global and a personal spam filter. The personal one kicks in after 200 spam emails have been ingested/deleted. You need to break it in, like a pair of leather shoes.
3. Before this 200 email threshold, make use of automated rules to just mark stuff as Spam automatically, if like me, they have all a similar pattern. When your personal filter kicks in, you're golden and works as expected.
I don't have any spam issue anymore and I don't think I've ever seen a false positive either. So now it's smooth sailing.
I wish Fastmail documented this process, which was explained to me by their support after a dozen exchanges.
Funny aside: all the spam overwhelmingly comes from gmail.com accounts. Seems like Google needs to work on their terrible outgoing spam issue. They're the biggest spam sender now that no one runs open mail servers on the Internet anymore.