100%. IP whitelists doesn't work for spam (+ they neglect VPN users and possibly Tor users). PoW could make it more expensive or slow down spam but doesn't seem like a solution. Kind of the same for rate limits. Regexes are also useless against spam, at least if the spam dev isn't lazy and uses a certain static/half static string. It's not easy to quantify something as spam or not.

Paid relays doesn't automatically prevent spam either but at least the relay operator gets paid for blacklisting the pubkeys and IPs that spams, and it's more of a bitter taste for the spammer to use money to spam crap.