Right, but speaking for the dev crowd, plenty of us have public identities. Anyone can find my email trivially by scraping github. If you have a public online identity in the first place, it’s far preferable to treat your public-facing email as public information, rather than to rely on security by obscurity and assume no one will ever discover it.

The only glaring risk from an online attacker is credential stuffing, and falling victim to that one is a skill issue tied right back to assuming your email address won’t become public.