They can bypass it, and as the user you can also use any other sign or character that you want. If you email is foo@ then you can use the letter x, as registrationxfoo@. A popular choice for a company email is first.lastname@, so you can use a . for it, or the - character. + is just what some program, like procmail and Sieve, will recognize without much trouble.

Using a a catch-all email with your own domain works also perfectly fine. Doesn't work as well if there is multiple email users of that domain.