Can you please clarify what you mean by “bad and spammy links”?
Are you talking about links in the press releases themselves or something else?
“Does this mean press releases are not a good thing to do any more, or is this the normal process? i.e. distribute press releases and then come back and disavow any spammy links?”
Stop and think about that. What would be the point of creating links you intend to disavow?
For what it’s worth, Google says it ignores press release links. If the press releases generate traffic when you publish them, then they are probably good for traffic (just not recommended for SEO).
That said, if you haven’t received a manual action (penalty notice in Google Search Console), then you probably don’t need to disavow the links. But should you decide to disavow them for peace of mind, don’t go out and create more press releases for links that you’ll ultimately decide to disavow.
Press releases should be used to announce newsy information that people would genuinely be interested in. Don’t use them to create cheap links.