Of course you don't need a CoC to enforce anything! You can moderate aggressively without one.
What it does is sets expectations. It sets expectations for everyone involved in any interactions. In general, this should give you confidence that there will be some moderation or recourse if you experience rude behavior. That may allow some people who have been burned by ruder communities to be willing to give yours a try.
> a way to assure newcomers that your project wasn't going to allow racist trolling on the mailing list
This is what seems a bit funny to me, because I would take it for granted that racist remarks would not be tolerated as a matter of course. It doesn't seem to me that you need a CoC to enforce this.
And I would repeat that in my personal experience, having been involved with OSS discussions for over 10 years, I have never personally encountered this.