Spam - truth is that bots and others may automatically guess for example info@ support@ and others. If alias will results in more spam, that is debatable. Usually anti-spam catch those.
Unwanted - Depending on your strategy, it may raise unwanted messages (not spam). People are usually lazy and does not finding right recipient. For example we use info@ as company wide-ish alias, delivering into several mailboxes, about 90% of messages are not for me in any way,… they even asking for specific recipient in body, but they still send to this company mail not to person itself.
Security - no alias not creating vulnerability. You can’t log into system using alias, because it’s not valid user,…
Good practice - This is hard, we use two public facing info@, billing@ and those RFC ask for postmaster@ abuse@,…
As I wrote before info@ is kind of a dump but still can be useful. Let’s say you want company social media page, it’s usually tied to specific user, usual workflow is register to bob@ but what if bob stop working for you? Than media@ or info@ is better. Or sharing one company account somewhere, those pesky 2FA over mail, problem solved.
billing@ has proven to be good. It always target accounting@ it’s real mail used as storage and history and john@ real person that change several times in last years,… This way you do not forcing your customers to change address for billing purposes.
That’s me,… looking for stories from others :-)