The DDOS of having your users scammed, spammed, them seeing illegal/harmful content, propaganda, whatever bots do.

Trying to get rid of bots is a worthwhile endeavor. How exactly you do it, and I criticize captchas as well, is up to debate, yes. But dismissing it completely just means you haven’t really noticed what those measures do. It’s like an IT department that just works and that management thinks is unnecessary.