At the browser level you have Captcha, which is a lot more expensive to spam - you need a human somewhere to overcome - than an API.

Depends on your definition of expensive. Captcha solving goes for around 1/10 a cent per catcha. (obviously pricier than free, but if you want to blast out 1000 tweets a day, that'd cost you $1)

You don't need a human for captcha. You can put together software pretty easily now that'll solve some captchas some of the time, and with automation even a 5% success rate means you can still get thousands of accounts.

They could easily detect and ban accounts that failed 95% of captchas, though.

The captcha tends to be during signup, not just any general request. Otherwise third party clients wouldn't work at all. So there isn't any "account" with 95% failure, only IP addresses that fit that. However, spreading requests to multiple IP addresses can help get around that, and botnet rental is pretty cheap these days (cheaper than the captcha prices that have been quoted).