The problem is that foo+bar@gmail.com and foo@gmail.com are delivered to the same inbox, so if you are trying to scam someone it is safe to remove anything after the + in a gmail address.
And having a custom domain on gmail doesn't improve your situation, because with just a simple 'dig mx' you can know if the domain is hosted on gmail and apply the same regex to remove all labels.
So, to be less inflammatory the feature works as expected. But it only protects you if the bad actor is really dumb/lazy or if he is honest.
And the 'fuck them, I won't do business with them' attitude doesn't really work if the system that wont accept your email is the local gas company.
And there is another problem, some systems will just remove any label without informing you. I've had this problem logging in some random websites. My account was created with foo+bar@gmail.com but to log I had to use foo@gmail.com.
For those sites, you can add a dot in your username. Then you can ignore any emails sent to an address without the presence of a dot or a plus.
I'm sure there are sites that don't accept dots either, but I've never run into one. So you have to make an exception? Oh well.
I agree that it's easiest to do with service@domain.tld, like the grandparent suggested.
+ sign is part of the standard (`atext` token, RFC 5322), so sites, which disallow it in address are doing it wrong. The fact, that industry adopted a practice of using everything after + sign as a "tag" is not captured anywhere so this creates even more mess in already messy space (e.g MS followed GSuite in this too and added subaddressing - https://learn.microsoft.com/en-us/exchange/recipients-in-exc...)