Yes. And I think the great thing about her observation is the naive view is actually true in practice (to some degree...). It is very difficult to distinguish between a 'legitimate' user that is a human and a bot. At least without reverting to captcha's and if the benefit to subverting the captcha's is high enough then you can just get human's to solve the captchas.