I did not get why people was so excited about Frames until I read this bit:

“The signed payload includes which button was pressed and a cryptographic hash that can be used to reliably identify the user that submitted it. That last part is important, because it means you can filter out bots from interacting with your Frame (or hitting the endpoint directly).”

This is, no need for CAPTCHA. You know that the user is a human because it is cryptographically signed transaction.

That's a good point - if it takes $7 to set up a new Farcaster account, then Sybil attack is expensive.

Actually making a Warpcast account in the US is now for free since recently