This is a bit off topic, but that was a real issue with WordPress some years back. The first spam attacks worked, but because of a well known weakness, hundreds of others followed, and that server crashed. Or the same weakness was exploited by script kiddies trying to hijack the whole system, and because they were mostly just another copy-and-pasters, their poor code and lack of skills broke everything.
One reality is that only a minority of spammers work like parasites, while the majority act more like bacteria or viruses.
That is not the situation with Discourse. But I reckon such situations are behind that concern.