Comment by jeroenhd

Regular users store the cookie and do the challenge once. Bots do it over and over again throwing out the cookies so they're not rate-limited.

Extreme configurations with high difficulty do make for a frustrating experience on very old devices, but in practice it rarely gets in the way.

Only the tail end of what one could consider normal users (those running custom browsers or having JS disabled or nonfunctional) run into issues here, but they'll have these issues with any other bot-blocking mechanism that still offers some protection these days.

Apple's "ask your vendor for tokens to exchange for access" web standard gets around this, assuming those bespoke and Javascript-less browsers implement PATs, but that standard seems to be completely dead in the water outside of Safari.