yes, the spammer is going to steal and scale their hashpower much faster than the casual user, if it works out to be a net profit
and note that "net profit" doesn't necessarily mean actual money it can be the sick pleasure of fucking with people, griefing, etc
think of the number of psycho trickster scammer bastard hackers out there who have resources to burn on this sort of thing - they'll hire cloud compute just to fuck with people, because their money isn't real anyway, it is stolen
a more structured system that is based on payments and provably fair random number generation is more likely to stay feasible for users