Unwanted "scam" outreach?

I know of one person who got this kind of message and they brought it up in the "Community Lead Support" community. Has anyone got feedback from ASF support on why this is happening in this platform? I thought we were safer from this?