What you are describing is similar to this:
https://bitcointalk.org/index.php?topic=5350998.0I'm not sure about the technical know-how, but essentially, in order to trade a token, you must first interact with the token's smart contract. This leaves the user vulnerable to having their wallet drained. However, keep in mind that this information can be inaccurate in some way, so take it with a grain of salt.
In the end, don't engage with them nor exchange them in any way for your safety. You might also assume that your wallet has been compromised, particularly if you frequently receive shitcoins. It can mean that your address has been shared/sold to elsewhere.