This has been flagged as a risk in our security testing. Obviously, developers could enhance the base Users module to use CAPTCHAs, but then you have to worry about upgrades. CAPTCHAs should be a core feature.