You can make it FOSS and still have some sort of subscription for syncing between devices for example. Tasks.org did it like that.
Not to mention that you can run something on donations like lichess or F-Droid and have some extra money.
Spam-bots and strange links.
They probably can but only after manual analysis.