Any public form, contact, registration, feedback, will eventually be found by bots. Without protection, it becomes a spam cannon or an enumeration endpoint.
The defenses are cheap: rate-limit by IP, add a honeypot field bots fill and humans don't, and validate server-side even when the client already does. CAPTCHA is the last resort, not the first, it taxes real users.
The goal isn't a fortress; it's raising the cost of abuse above the payoff. Most bots move on to easier targets.
