People can still join public groups with new, regularly created profiles and spam them from there. I’m not sure how to prevent that, because AFAIK a group join message is indistinguishable from pretty much all other traffic on the network.

Spamming you directly, that’s not really much of a concern.

And yeah, Telegram has been a joke in terms of both privacy and security since its inception