No, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
They have so many accounts broken daily? Then credential stuffing attacks are not prevented.
Then you don't need to automate it, and you can just manually solve the captcha and log in.