However most sites reveal existence of an account before requiring a captcha, and many sites can't even fix this.

e.g. Twitter can't require captcha before letting me see twitter.com/username …but they're still doing this security theater.