self wrote

From my understanding, the CAPTCHA is a very low intensity operation that barely takes any server load, while logging in ot registration or making purchases or even browsing like a script would do repeatedly to complete a DDoS attack. Having a CAPTCHA effectively prevents scripts from doing these high intensity operations multiple times per second.

For clear web sites this is an awful approach, but since you can’t really block IPs on Tor, it’s the best and most effective tool market owners have.