Those things are why I said close to sufficient, not sufficient. For best results you will want some other form of behaviour analysis also. But reCAPTCHA suffer

Those things are why I said close to sufficient, not sufficient. For best results you will want some other form of behaviour analysis also. But reCAPTCHA suffers from serious problems too; it’s easy to find turn-key reCAPTCHA-solving services at under $1 per thousand. So reCAPTCHA is a deterrent, but far from inviolate, and for most of the kinds of attacks we’re talking about here it’s not even a particularly severe deterrent. (It would be for comment spam, since the value of each attempted submission is negligible, but for credential stuffing the expected value of each attempt is much higher.)