Bot farmers could find an exploit in reCaptcha. Or they could train up a neutral network to accurately defeat them (I saw someone demonstrating a GPT4 prompt that could handle it quickly and flawlessly with just a little bit of prompt engineering). When (not if) they find a way to defeat captcha, those lower level protections become way more important and relevant.
It’s an ever-moving set of problems; fixing it today is no guarantee that it’ll still be fixed tomorrow, so everything has to stay in place until it’s proven to no longer be effective or to cause more problems than it fixes.