I share your skepticism.

CAPTCHAs are at best a game of cat-and-mouse, and are always open to relay attacks anyway.

You can still verify in-person, and even check documents, but no web company would even consider doing that, even for something like an optional 'fully verified account' tag.

Even something like checking a phone number just means that you're limiting the number of legitimate "bots" or alternate accounts people can have.

Indeed, that's a good way to raise the bar.

For small websites, even a completely trivial email check is enough to keep out most spammers.

Yeah, that sounds practical for every start-up that needs to do human validation.