The exploit works because Core neglected to update the spam filters a few years ago, and refuses to fix the vulnerability.

And no, you're wrong. Satoshi's spam filters were VERY picky about what was inside transactions. Anything that he didn't foresee being used was rejected.

Core30's malicious changes have nothing whatsoever to do with Taproot.

Each user decides for himself. Collectively, our nodes form consensus around what is spam and what maybe isn't.