It indeed does not stop spam, it does (partially) stop faking your source email domain, which could partially stop virus spreads, but that would require that a large (>75%) of the global is using it. No check somewhere -> does not work.
SPF will only work for scoring, but not for rejecting e-mails.
it's like IPv6 - you cannot expect the whole internet and all domain admins to really put SPF in place - so you'll have around 15% of domains which are using SPF and the rest is not using it or even aware of it (implify everywhere ~all).
-steven