Even smaller established websites get a ton of comment spam these days. I'd not even consider setting up any commenting system that doesn't have robust spam protection.
I have a little bit of code similar to yours for comments, I just wrote some glue to require Google or Facebook authentication through AWS Cognito to make comments. Some people will hate that, but it worked.
I've already had to edit the JSON file on S3 to remove/edit a couple of comments. That was pretty easy to do from the command-line, but I think most people will want a web interface.
It will desperately need a moderation queue.
Even smaller established websites get a ton of comment spam these days. I'd not even consider setting up any commenting system that doesn't have robust spam protection.