Its not a whitelist. Monetary use always needed its (consensus and mempool) rules and filters to protect it. Permissionless Bitcoin is ability to send Bitcoin to any Bitcoin address, not to send spam.