I run so many dynamic things of many different kinds and cannot confirm this in the slightest.

There's the obvious things like public forums or contact forms where spammers submit messages, but "anything that has a dynamic backend of any kind" is just not true. Most things don't lend themselves for making money.

I do agree that we could do better about tackling the abuse that does happen, both by law enforcement and by sysadmins simply banning IP ranges whose abuse center doesn't make any attempt to solve the problem.