I also emailed Tobi, in mid-December (to the email address which he publicly lists: tobi@shopify.com). However, nobody from his office got back to me on this very serious issue.
I have also corresponded with at least three Shopify support agents. They have been a) either unaware of the problem, or b) they continually try to pass it off as a “backlink” issue.
This is not simply a “backlink” issue, because if the spam pages could not be created by exploiting the Shopify system, then the pages would not be indexed by Google (or any other search engine), and therefore there would be no risk of customers seeing the spam pages and being scared away from our store (or potentially millions of other Shopify stores).