I still sometimes get spam comments on sites where I do not have the comments activated. The only way that they can do that is with automated bots that inject the spam comments directly into WordPress.

Just ignore everything that ends up in the spam bucket. There is no reason to go through it and no reason to be concerned about it. It is automatically deleted after a few weeks.

You are correct about the Internet becoming a spam cesspool, but that should be stated in past tense, not present tense. It has been a cesspool for a long time. People will do what they are encouraged to do and the Internet makes a lot of this behavior easy to automate.