I've been using my own domain with a catchall for over 10 years and never had problems with spam. Spammers tend to send to harvested address lists, not just try to send to random mailboxes for a domain.

The backscatter can be annoying though. I had none for over 10 years either but it's picking up now to perhaps a few per month. Looking around how to prevent it, apparently "backscatter" is an established term for the phenomenon that you can't fix, where you receive rejected spam emails, and they're often sent from randomly generated prefixes @ your domain (no matter that you have SPF/DKIM/etc. set up). My partner also gets waves of autoreplies, like "your support ticket will be handled soon" and "I'm out of office until ...", where someone seems to have used their domain with a random prefix no apparent reason

The solution is probably to tell the senders that they're effectively sending out spam / doing a variant of open relaying by emailing the spoofed address, but even internet-savvy institutions like an IP address assigning organization (RIPE) sends me backscatter so I don't have a ton of hope

*@mydomain.com worked fine for me for about 15 years, then suddenly spammers started doing exactly that, sending e-mails to random addresses. I would get countless copies of every spam message, addressed to completely random combinations of characters @mydomain.com.