You're right that you may get a lot of noisy authentication spam texts. Alas, none of the companies involved seem to care. Judging by their popularity, most of their users don't seem to care much either.

Is a captcha enough? I've never worked in bot/spam mitigation for a large public platform before, so I don't really know. Based on how universal phone number requirements are for these services, and how much trouble they seem to have gone to in order to block using easily purchased numbers, I'm going to guess that captchas aren't enough.