Not every service will be targeted by sophisticated bots. What kind of service are we talking about? Is it even social? Is it even a service or just a public website?

OP did not provide a threat model or any description of the service really.

Talking about this "in general" is awful and leads to stupid bullshit like endless CloudFlare captchas on literally STATIC blogs.