Modern spam filters are highly effective but imperfect. They analyze message content for known spam patterns, check the sender's reputation against blocklists, scan embedded links against databases of known malicious URLs, and use machine learning trained on billions of messages. Even so, a small percentage of phishing emails reach the inbox.
The difference between spam (nuisance) and phishing (dangerous) is intent and targeting. Spam is bulk, low-effort advertising. Phishing is targeted deception designed to steal credentials or install malware. Phishing emails that pass spam filters are particularly dangerous because their presence in the inbox increases trust.
What to do with suspicious emails: do not open them, do not click anything in them including images (which can be tracking pixels confirming your address is active), do not click "Unsubscribe" in suspicious messages (this confirms your address is live to spammers), and report them as phishing using your email provider's reporting function.
If you receive legitimate marketing email you no longer want, unsubscribing through the provided link is appropriate. The risk of confirming your address applies only to genuinely suspicious messages — not to newsletters and marketing from companies you actually have a relationship with.