> It keeps phishing attacks from being able to cross services (since if you get a citibank email to your coinbase email that would be a big flag) and it reduces the attack surface on other sites.

Or, more importantly, it lets you authenticate the sender in some way. Citibank has to send you email to [email protected] and it is unlikely for a spammer to guess that exact wording (without also trying hundreds of others, which would give it away by filling your inbox).

[email protected] is at least a distinct email address, unlike using +. Especially if you use different passwords for each account, it means if one of the emails is compromised then the attacker can't use it to recover passwords of your other sites.

+ can be a distinct email address, just as . can be an alias. It really depends on how your email server is configured. Postfix makes it really easy to adjust what character you use.