> The problem is if someone figures it out and starts sending you spam to {random}@domain.tld.

It's a non-issue. I've been using a catch all domain for at least a decade. I get a small amount of spam to random made up emails but not enough to care about plus it all gets caught and filtered.