Are spam registrations a threat to a Drupal 7 site Yesterday, as I was explaining to a client that someone would need to remove spam registrations, the client asked me what difference it made if they are in the system because we can just turn off all privileges that anonymous users don't have. 

I was not able to give her a compelling argument of why this clean up is important. The fact that I like to keep everything on a website nice and clean was not a compelling argument for her. What are the security or other risks in not cleaning up the spam users?
Will there be a number of authenticated users on this site who are not spammers, or does your project only require a few users to create content? If it's the latter, the best bet is to simply turn off user registration, and have the owner create accounts as needed. If the former, programs like Mollom should help with cutting down spam and the basic package doesn't cost.

As far as performance goes... if spammers can post content, the obvious issue is comment/content spam. You can use the Disqus module to mitigate this, i.e. offloading the work to Disqus. If not, then if you need to send emails to all users through a service, then you will necessarily have email list bloat. If the volume gets very high, then you could potentially have availability issues, though I don't see that very often.