I always assumed that, if spammers were intent on exploiting mailing lists, they would sign up for the list or crawl the archives to figure out who's on it.

Most of the spam I've seen moderating a web forum seems to be aimed at search engine indexes, and not at the forum users themselves. This is why the spammer would start out by copying questions from a different website*, then start silently injecting their spam links later, after the software stops sending the spammer through the mod queue every time they include a link. They don't even want the forum users to see the link; it's entirely for Googlebot's eyes.

Obviously, this is just as applicable to mailing lists as it is to forums, as long as the mailing list has a public archive. We can assume that if mailing lists aren't receiving as much abuse as forums are, it's because the spammers don't think the ML archive has enough page rank to justify it. A lot of them even use human beings in sweatshops to solve CAPTCHAs, if you're thinking that would help.

Forums have the ability to remove all the bogus posts after someone notices the spam links. But how would you remove them from the locally-stored archives that mailing-list users maintain? I brought up USENET cancel messages for a reason: purpose-built discussion board software has needed this ability since the early 2000's at least. You can't just wish the need away by deciding that some sense of free speech is more important, and it makes no sense to advocate for it if your anti-spam strategy is actually to just remain unpopular enough to not be a target.

* or "spinning" questions with a markov text generator, which is sometimes obviously machine-generated gibberish, but sometimes just looks like the kind of gibberish a newbie who is totally lost would post