In addition to what the other user said, usernames are both optional and easy to change in order to prevent spammers from finding you. Plus, they can only make so many accounts themselves, with the phone number limitation in tow.

Don’t accept the message/block them? Same as any other DM system. Or just change your username.

Matrix isn’t private at all. All metadata is shared+stored by both your server and mine (no sealed sender). Encryption is worse (no double-ratchet) and there’s no guarantee of encryption at all (some clients don’t even offer it). It’s also a lot harder to get set up and IMO the clients are much worse.