I think you're confusing intent with implementation. You're right that the implementation excludes non-malicious bots and fails to solve for malicious humans,

I think you're confusing intent with implementation. You're right that the implementation excludes non-malicious bots and fails to solve for malicious humans, but that just makes it an imperfect implementation of the intent: which is to differentiate malicious & good.