It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve also never tried it.
Firstly, we can see that they're using the email exactly as provided (for sending, at least), else filters on the mail we receive wouldn't work.
Secondly, the + trick works because it's valid in email addresses under RFC 5321 and RFC 5322 - the fact that Gmail (and others?) direct all addresses of the format 'foo+bar@gmail.com' to the mailbox of 'foo@gmail.com' is a quirk, not a given. Anyone wanting to trim '+bar' would have to know it's safe to do so for particular providers, and I doubt anyone wants to maintain that list and do extra backend work just in case they want to share on the sly.
Gmail is also pretty popular, so it's not much work to just hardcode it there.
Also, most of the automated email systems are not as sophisticated as people think. Ours actually relies on + wildcards for internal testing.
If you are just trying to datamine for random email addresses, you can do that with a random string generator. If you want a list of Netflix customers accounts, you probably want the same exact email they signed up with.
Besides, you can always make a Gmail rule to junk any emails coming in without a modifier.
I'm not saying they will strip out the + from the primary email address used for login/etc - that would be dangerous for many reasons and could deny access to users.
But they are absolutely likely to strip it out for obnoxious behavior which is only valuable at scale and individual failures don't matter - such as ad targeting, email spam, etc. In this case, it doesn't matter if you fail to spam the 0.001% of users with + as part of their actual username if it means you manage to spam the 2% that use + as an alias separator.
I'm not saying there is not someone out there trying these shenanigans, but in 95%+ of situations you are still going to catch people sharing your data with a + modifier.