Correct: 'Non-heuristic antispam' and 'Private device identifiers' are incompatible requirements, unless you introduce another expensive obstacle to overcome. Spamming depends on cheap/free sock puppet accounts. The cost per account is inversely proportional to the value it holds to spammers. That cost can be in Apple's iMessage terms: $100+ per serial number, all devices must include burned-in serial number attestation in their server communications. Or that cost can be in bureaucracy: $10 per notarized "account signup request with verified citizenship", but now all communications can be associated with the notary's logs of your citizenship ID number.

There is no way to stop spam without incurring one or another cost to each user. Apple's method doesn't care who you are, so long as you possess Apple hardware. The Pluton method wouldn't either. What other methods exist that are unconcerned with the exact identity of the user, but still make spamming unprofitable?

As far as private antispam, you can imagine a hashcash-like system that takes into account how many messages you've accepted from the sender, but this is a completely different discussion.