pull down to refresh

Are these attacks only applicable if you spend from the address? Is it just as safe, not counting privacy, to receive multiple transactions, as long as you don't spend?