That is why there is this soft fork bip that fixes a lot of weaknesses that are exploited from spammers 🤙
New output scriptPubKeys exceeding 34 bytes are invalid, unless the first opcode is OP_RETURN, in which case up to 83 bytes are valid.
OP_PUSHDATA* with payloads larger than 256 bytes are invalid, except for the redeemScript push in BIP16 scriptSigs.
Spending undefined witness (or Tapleaf) versions (ie, not Witness v0/BIP 141 nor Taproot/BIP 341) is invalid.
Witness stacks with a Taproot annex are invalid.
Taproot control blocks larger than 257 bytes (a merkle tree with 128 script leaves) are invalid.
Tapscripts including OP_SUCCESS* opcodes anywhere (even unexecuted) are invalid.
Tapscripts executing the OP_IF or OP_NOTIF instruction (regardless of result) are invalid.