It is true, but important to realize that in some cases it is based on a very small sample, and also which TLDs are on this list vary from week to week, somewhat.
Spamhaus are the experts on spam, with their results used to protect about half of all of the email boxes in the world. They have a significant staff, 38 investigators currently, and have been doing this for over 24 years. Read more about
Spamhaus here. As an international nonprofit they have no stake other than in reducing malicious actors and spam.
The way they do it is they compare the number of bad specific domains with the total number of
active (i.e. used for email) domains to get the percentage. The score is obtained by multiplying this percentage by the logarithm of the number of bad domains (see
https://www.spamhaus.org/statistics/tlds/).
As pointed out, .surf was bad but that was based only on email accounts that were 'bad' on 176 different domains. Maybe not significant, but there were only 270 domains among the much higher number registered that appeared in use for email.
Just to the left of this listing of 10 worst, one can in a pull-down menu check any TLD for percentage and score (but not number active and bad, unfortunately).
Most of the time the free country codes, and some selection of lightly used new gTLDs, comprise the worst 10, although occasionally others (such as now .cn).
-Bob