I deployed and have been maintaining a very small Mastodon server (~10 active users) for several years now and I can say that at my scale it is not difficult (for someone with modest technical abilities but no professional sysadmin experience). Sure if your instance is as large as Mastodon.technology and you are the only admin doing it as a hobby/side-gig then things can get rough.

Regarding spam, there is some (seemingly inevitable in any community involving humans). But frankly Mastodon, right from the beginning, focused heavily on Moderation tools. Figuratively speaking, no expense has been spared to make it easy and convenient to block bad actors (or instances) from your account (or your whole instance).