Haven't you heard of the "Swiss cheese" model of security?

The best way to ensure your server is protected is to unplug it from the Internet and put it in an EMF-shielded Faraday cage.

There's always a tradeoff between security, usability and cost.

captchas can be defeated, but that doesn't mean they're useless - they increase the level of friction required to automate malicious activity. Maybe not a lot, but along with other measures, it may make it tricky enough to circumvent that it discourages a good percentage of bot spammers.