[properbrew]

I think it depends on how determined the actor is. I see all the range from your simple scripts to full on mimicking real user behavior that I can only really spot from the honeypots they hit.

You'd probably catch most the low hanging fruit for sure, but you would cause friction for real users.

I say this as someone who has enabled captcha on some of our more critical endpoints, there's definitely a place for it.