I'm not sure how well this will actually work against a determined attacker. The browser challenge takes less time and money to automate than the already existing captcha solving services that use actual humans to enter the captchas.

Although I'd certainly prefer something like this being the default approach over hostile measures like Recaptcha v3, which just outright deny a subset of your users access.