A spam bot can put reactions to messages in an open group without joining it. The group member sees a pop-up notification about reactions to their message, looks to see who put the reaction and writes to the bot, or sees the spam in their profile signature.
Unfortunately, I don't have my own spam bot to reproduce the bug. But you can see my post in the public group, under which the spam bot left a reaction, and other similar posts: https://t.me/vtb_chat/188532
public group bug