No + required. There are hundreds of companies offering aliases using their shared domain. You can also just generate a temporary email address if you don't require any ongoing communication and the account is not super important.

At the same time, it is trivially easy to strip a + alias, so I'd not trust it to do anything much at all.

+ aliases are convenience aliases only. They are often stripped from ID datasets. Better to use a real alias.

I use my own domain with a catchall, works like a charm

I use either, depending on the application.