It doesn't appear automatically, it's programmable [1], you as a developer decide what to do with a low score, you could ask for extra verification for example. I agree with the tracking and privacy issues with ReCAPTCHA.

[1] https://developers.google.com/recaptcha/docs/v3#programmatic...