

Because like I said, different measures hold back different bots.
If there are 3 bot softwares, maybe 1 can solve captcha and use accounts, 1 can only make accounts, 1 can only use captcha.
With only account login you get 2 bots, with only captcha you also get 2 bots, with captcha before login you only get 1 bot.
The DDOS of having your users scammed, spammed, them seeing illegal/harmful content, propaganda, whatever bots do.
Trying to get rid of bots is a worthwhile endeavor. How exactly you do it, and I criticize captchas as well, is up to debate, yes. But dismissing it completely just means you haven’t really noticed what those measures do. It’s like an IT department that just works and that management thinks is unnecessary.