The general rule of the Internet is that everything gets spammed, so at one level it should be no surprise to me that bug reporting systems for open source projects do. As it happens, I sort of have personal experience with this, especially through this old bug for AMD Ryzens hanging on Linux, which I'm subscribed to because it sort of affects me. Actually reading the bug will generally not show you any spam, but that's because people go through and remove it quite promptly when it's submitted. I know about the spam because I get the standard Bugzilla email when someone submits an update to it, including a new spam comment.

(I'm pretty sure the Fedora Bugzilla instance gets spammed too, although perhaps less than the kernel's.)

Since you have to register to leave new comments in the Linux kernel bugzilla and the spam persists, the spammers are either doing this at least partially by hand or have automated the process of registering for Bugzillas. This isn't just the usual automated form stuffing that goes on everywhere.

(When I say 'the spammers', it could be people that they've hired to do it in low-wage areas.)

That this happens doesn't so much make me sad as make me angry (again) at the spammers, not just because of the spam but because of the way they progressively ruin everything on the Internet. Behind the clean looking Linux kernel bugzilla bug entry is some number of people who have to shovel out the stables and worry about how to try to stop the inflow, and the same is true for lots of other things. Everything on the Internet today that allows people to send in content has to deal with spam, which means that spam is a tax on all of those things (and one that wears away at people). I'm sure that there are things that aren't being built because of spam, or that are being built differently.

PS: I believe that the Linux kernel bugzilla spam I've seen has generally been attempts to plant links to various sites. Sometimes it's just a big spew of URLs, but sometimes it has some text (even sometimes text that's plugging its links instead of just filling up space).