You can easily add events to your iCloud Calendar through Safari. This is useful if you want to keep track of events that you want to attend or be reminded about, but this ease of use is what is leading to some people abusing the system, resulting in users finding their iCloud Calendars filled with spam events.
This is a problem that was affecting users way back in 2016, but fast forward to today, it seems that it is still a thing. This can easily affect users because one of the ways that these spammers trick their victims into adding spam events to their calendars is through a popup box in Safari. This popup looks legit and for some, they might tap on OK just to move on to the website.
https://twitter.com/bieberfluid/status/1406670511808057350
For others, this comes in the form of emails like invites to an event or to view/share an iCloud Photo album. The problem with these invites is that tapping Decline would seem like the obvious thing to do, but doing so simply lets the spammer know that the account is active and they will then keep sending you these invites.
Apple has implemented certain measures to help deal with this issue, like being able to unsubscribe to Calendars from people, reporting junk, but the fact that this is still an issue even today suggests that maybe the company needs to step up their efforts.