And the reason for calendars is because the reminder that an event is starting is usually sent as an email from Google, with the description that has spam links. We've been training people to look at the sender to gauge trustworthiness, and with a sender of google.com, people feel like they did due diligence and can trust the contents of the email.

I find that Ctrl+F doesn't work so well on paper

Keep in mind, nobody is "getting to" your calendar. They don't have access to it at all.

They simply send an event invitation to your email address. And because you're invited to a thing, your mail app "helpfully" adds it to your calendar.

They don't know whether you have a calendar. They just send them to thousands of email addresses hoping that somebody will see them.

Yes, it really is spam. I got one of those spooky calendar entries once years ago. I'm glad it doesn't happen more than once or frequently at all. I would really hate that. It's spam. Report it and/ or ignore it.

If you want, you can also remove the google calendar app if you don't use it, along with any of the other bloat on there. Seems a bit involved but might be easier then you think.

https://umatechnology.org/how-to-uninstall-any-android-app-with-adb-including-system-apps-and-bloatware-2/

https://technastic.com/google-apps-package-names-play-store/