Android nowadays marks calls as "suspected spam", worked great. In general, if it's important enough, the caller leaves a message. Otherwise, it's not important and I don't care about it.

That's great, and iOS now has a similar feature.

It has zero effectiveness if someone decides to send a hundred thousand spoofed VoIP calls at you because you lost them their spammer/malware job by stringing them along.

There's no way for them to do that for free -- VoIP calls to PSTN still cost money.