> You can use PoW as a sort of captcha, for example. If it costs a little bit of CPU to submit a request to a website it's not a big deal for a human. However, if you're running a bot-net suddenly it starts to hurt!

That's exactly what HashCash was conceived to do (to fight email spam). It was a neat predecessor to Bitcoin.

botnet operators rarely pay for the electricity or hardware of their botnet. why would CPU usage hurt them ?

Depending on what the Botnet is trying to achieve, CPU can be “expensive” in a time sense. If you are doing a credential stuffing attack with something like a COMB dump, then every cycle counts because you have a ton of creds to check.

A lot of them are using budget VPS services, or even Amazon/Google/Microsoft cloud services.

True, it won't solve the problem of malware botnets, but PoW or PoBandwidth schemes can make it too expensive to run botnets on cloud services so the only place left to go is illegal botnets.

Isn’t this just bcrypt?

Almost. PoW allows the entity validating the work to determine just how much work it thinks is appropriate at the moment of authorization, whereas the number of hashing rounds for bcrypt is determined at the time the secret is stored.

So if I lock up a secret with bcrypt today and require 100k rounds of hashing, it will still require 100k rounds of hashing to unlock for any brute force attempt of the ciphertext for the rest of time. A server (or blockchain network) could evaluate a PoW submission 50 years from now and determine that difficulty should be raised to 100T rounds instead of 100k rounds.