Baiting alone is not a reliable long-term solution, because it both interferes with competitive games (a lot) and because it requires you to basically stay on top of a captcha escalation (especially once cheaters limit themselves to "realistic" reaction time constraints), and this is a bad position to be in (because it means continuous effort for the developer).

The most helpful approach in my view is to make fresh accounts expensive for cheaters so they can't iterate easily; if the game developer can extract profit from such ban circumvention attempts then all the better.