I have some evidence that simple QAs works to keep out the spammers:
Earlier this week my forum server crashed, and I decided to move to a new provider. While setting up the new forum, before I had applied my backup, the "virgin" forum was available for about 10-15 minutes. In that brief amount of time, 4 spammers had registered, and were posting ads for Canadian "stiffy pills", etc.
Once the backup was applied, with my 3-4 simple QAs, no more spam.
I don't think it's really fair to blame XF for the spam problem. They have decent tools for cleaning it up (Which I'm sure will be improved once development can commence again) and sufficient support from the community if you want a more robust third party solution.