SPHINCS+ is an elaborate scheme building up on very simple blocks. It's all down to cryptographic hashes, there is no other security assumption involved.

There is a good talk given out by a NIST guy that starts from the simplest one time hash signature construction and builds up to XMSS/SPHINCS: <https://www.youtube.com/watch?v=jiU0ICoiPI0>

TLDR;

SPHINCS+ is a hypertree of Merkle trees where leafs of Merkle trees are used to sign Merkle roots of other Merkle trees. Leafs of the hypertree (final layer of Merkle trees) are used to sign messages.

Paths through the hypertree need only be constructed on demand through the use of a PRF - computing paths through the hypertree requires computing entire Merkle trees. The private key is just a secret key to a PRF.

A hypertree can be as big as you want it. Merkle roots are parts of the public key and public signatures and can only be determined through computation, if the Merkle tree is too big you will not compute the root in reasonable time.