When I stood up my current discourse instance this past summer, I had about 100 spam accounts sign up within 24 hours, all with throwaway email domain accounts (all of which had functional SPF and DKIM). Turning on hCaptcha eliminated the problem entirely. I deployed discourse on an existing site to replace native WordPress comments that were absolutely swimming in abusive spam, and the spammers immediately shifted tactics to follow.
I can’t speak to “most sites,” other than to say that that your personal experience is not mine. The benefit for me is a massive, measurable decrease in spam sign-ups with hCaptcha. Validating e-mail accounts is not a barrier to spam sign-ups. I appreciate that hCaptcha has an official Discourse plugin, though I’d prefer to use Turnstile because of the added value.