Yeah, it uses real user's cookies to accomplish it, but I was also able to break it with traditional captcha-breaking mechanisms after Google presents the fallback. The point I'm making here is that this change doesn't really help much with proving that you are a human.

It kind of is, actually. Cloudflare, for example, uses a single CAPTCHA to prevent ongoing DDoS attacks. If they switched to this new reCAPTCHA and if a DDoSer can use Selenium to get past the challenge, then the CAPTCHA process has failed.

There are always tradeoffs with this. I strongly suspect Google is going to have to restrict it within a year or so, resulting in the number of users who still have to solve CAPTCHAs closer to 10-20%.