Spam, phishing, virus blocking - no builtin measures. It is easy to integrate rspamd (literally adding one line into config). ClamAV can be used via clamav-milter though some configuration is needed - no direct & easy integration for now.

maddy implements de-facto standard milter protocol so it is possible to use any third-party filtering software supporting it.

Mailcow is a great system. I use it and I love it.

But it's a total mess. So many different components glued together, so much that can go wrong. The configuration is scattered into hundreds of files. There is no clear split between the product and user-configuration. To change some settings, you need to make adjustments in the core product (the config files that hold everything together).

Replacing a lot of components with Maddy would probably make projects like mailcow way slimmer.