Correct. Spam is not a problem yet because nostr is super new and no one uses it yet. But a few friendly bots have been released for it (since it's very bot-dev friendly) and DMs are open by default (and the branle client has no way to close them) so spam is basically guaranteed to come eventually.