I have already taken measures with image authentication (Captcha), but do I need measures against bots?

In recent years, due to machine learning, etc., the failure rate of legitimate users has become higher than that of bots. Not only does it impose additional authentication on the user, but there are more and more exploit tools for attackers these days, and it is easy to bypass.
We are conducting a demo of a bot that breaks Captcha, so please check it out.