Almost certainly don't—I kinda assumed something that trivial would get handled by full-auto bots by now, but maybe not.

I haven't seen bot spam go past trivial things. A text field name="url" that's hidden via css gets filled by them. They don't execute JavaScript. Granted, those solutions won't work forever, once they are widely adapted, bots will adapt too, and they obviously won't stop targeted spam.