I can confirm exactly this. I started with a root catchall on my personal .com (~15 years ago), and it was quickly overwhelmed with dictionary spam. Switched to a subdomain catchall, and haven't seen a dictionary run since.

Picking a short preposition for the subdomain can even help when you have to communicate the email to a clueless phone rep: "That's right, it's [email protected]"