As someone moderating an instance: good moderation is only part of the reason a user might not getting spam. It looks the the waves of attacks hit more active/followed/boosted users on the server before everyone else. Presumably they function the same way as instagram spam campaigns and go off recent posts to target folk with tagging. So our two most popular users are doing basically all the reporting and suffering, and everyone else (who isn't a mod) has no idea anything is happening.
There's some stuff the mod team is doing with importing block lists and adding special rules that should help everyone, but a lot of it relies on us getting at least one report to trigger action because the Mastodon mod tools are not super powerful.