Yes, but unlike crypto, a CAPTCHA doesn't need forward protection. If I deploy one, and it turns out to be weak, I can just upgrade and then not worry. I'm not worried about people time-traveling to the past.