I never really thought of them protecting the user,
I thought they protect the site more in a way, by having captchas they prevent bots from spamming websites, or bots creating multiple accounts for sites.
I suppose it could be said that entering a captcha when you log into a website could protect a user so that a bot can't try to get into a user account but the better and more used method is to not allow anymore than a certain amount of attempts to log in.
I think that's a better way since depending on the bot and the strength of the captcha they can some times be bypassed by bots, captchas can be made stronger but then they get to the point where they're hard for humans to read.
Or am I misunderstanding your post and you were referring to something other than what I just posted?
