I’ve switched over a year ago and that’s the thing that, looking back, sticks out to me the most as well. It’s just insane that practically every application I used had its own update routine. Lesser used apps I had to update every single time before using them. Just constant interruptions everywhere.
Winget is a step in the right directions, but it still has to build upon and work around that same shaky foundation, and it shows.
I believe there are some services, including some selfhosted ones, that allow you to quickly create (and later delete) unique aliases.
That said, I was surprised that these dictionary spam attacks don’t really happen all that much, at least based on my own experience. Most of the ambient drive-by spam my server receives targets email addresses belonging to domains I don’t even own. Blocking those and a few Sieve scripts gets rid of 99% of spam for me.
Interestingly, there was one time I received spam to a bogus address belonging to my own domain: A while back, one of my actual email addresses got leaked (thanks Sega) and a few months later that address got copied into another dataset but with a typo, which I assume was caused someone using OCR.