Same laptop, about 22 seconds in Chrome and about 5 ms with the custom GPU solver. After that, your point about botnets just solving the PoW and getting through sounds pretty believable to me.
I've seen it happen countless times through logs. They just don't care if there's a PoW in the way, they just solve it anyway and move on. When you control a botnet of 10s of thousands of compromised residential machines (residential proxies I believe they're called), you almost have very little recourse except to make it cheap or detect the pattern adn block it (not trivial).