The point is that foo+bar is a convention that many providers follow and not an actual rule of email, and therefore blocking that doesn't make sense because you'll block legitimate addresses too.

Similarly, mail providers can come up with all sorts of different conventions if they want. For example, when setting up a new domain in FastMail, it offers the ability to accept [email protected] and turn that into [email protected], and it offers [email protected] which it will deliver to [email protected]. So here we already have two new conventions that sites can't possibly detect as alternatives to the normal [email protected].