Nowadays, not having a captcha on user login presents a risk that goes beyond just preventing bots; it also mitigates threats like DDoS attacks and other account validation exploits.