It's a cat and mouse game, of course captchas have been defeated in the past, but captchas just keep getting increasingly complex. Currently, for anonymous requests, reCAPTCHA by Google, which is what Cloudflare uses, asks you to "choose bodies of water" or street signs from a series of images, with each click sometimes revealing more options. It's fairly complex so I guess it hasn't been broken yet. It's also a massive pain in the pass for legitimate visitors.