I’ve actually never used Hugo (in fact I don’t think I’ve even heard of it before reading your post).
I really love Jekyll for my purposes. All I really need is a way to convert a bunch of markdown files into HTML files, which is exactly what Jekyll gives me. It’s not the right tool for every problem, but it’s exactly what I was looking for when I started putting together this site.
What makes static sites immune to spammers? Well, the fact that they’re static. That means there isn’t a way to add content to them by default: no comments or posts (other than from the original author) or user accounts. I use Discourse as a forum and for comments on blog posts, but all of that is external to Jekyll. By default Jekyll just gives me a bunch of HTML files that I can upload somewhere, which isn’t something that spammers can really take advantage of because they can’t add any content.
The best advice I have is to try out both and see which one solves your problems better.