Yes, hypothetically I guess in the future a sophisticated spammer would build their own client and wardial accepted pubkeys and use those pubkeys until they are exhausted.
I guess nobody follows spammer pubkeys, so spam is mostly a problem for General channels and discovery of new pubkeys to follow. My own feed has no spam, because I donāt follow any spammers.
Spam is also bad for new users as General channels and pubkey discovery are the main place for new users.
But youāre right, for noteIDās it would need to be the client doing the POW after the user hit send.
Youāre also correct that for it to all work in a standardised way across the network it would have to be a part of the protocol.