Earlier quoted context omitted.
Both of these are well known features. And you can "normalize" a Gmail email address - basically stripping your defences.
Yes and no. First that assumes someone is bothering. Plenty of places don't, as my spam collection shows. It always amazes me how little technical know-how or design goes into high cost solutions. And second: just reverse the logic: emails to john.doe@gmail.com are whitelisted. All others go to spam. So even if someone is "normalising" it actually works for Mr Doe... I hope this helps!
It even reached HN frontpage: https://news.ycombinator.com/item?id=34400024