Yeah but filtering out mindless bots is even easier than loading a bloated mess of JS: a simple form question that you believe 100% of the valid users will be a

Yeah but filtering out mindless bots is even easier than loading a bloated mess of JS: a simple form question that you believe 100% of the valid users will be able to answer should be good enough to stop almost all of those low-level bots. I use that approach all the time. Some day this luck will run out, but for larger entities that experience targeted malicious traffic it's never really been a viable approach.