I have received phishing attempts for cryptoscams that still had my tagged address and identified the source of the leak that way... but I'm sure there are more cautious scammers and spammers who removes it, still can be the poorman's version of a catchall address I guess.
I always give out myname+tag@... to places that ask for email, and have an incoming message rule that puts bare myname@ straight into spam folder.
So far, the only messages to bare address were service updates from my email provider itself.