Phones could be set to "allow incoming calls from contacts only" by default.

Then a spammer has to persuade you to add them to contacts before they spam you