That depends on the complexity of the bot. A general purpose bot might not get through a complex process, but someone could spend just a few minutes to customize a bot to a particular site. CAPTCHAs are reasonably good at stopping bots.