Because it's not as effective if the goal is to catch spam. Spammers are already wise to the meaning of + and will strip it automatically when selling data in bulk. Plus, some services block creating accounts with the + or with their name in the address.

Block any email to the address missing the +

Then you end up with spammers simply putting gibberish after the plus sign.

How do you mean? This is exactly what I can do with my setup. If you are referring to the use of Gmail: I prefer to run my own infrastructure as long as this is possible.