I run a Moodle server exposed to the Internet - https://nukit.ihelse.net, until Dec 2016 Moodle 2.9 on Win 2012 R2 server, now migrated to Moodle 3.2 on Oracle Linux 7.3.
We run course for medical specialists (Nuclear Medicine - see http://bora.uib.no/handle/1956/11945). Our teaching library contains real but anonymized cases.
When the solution was approved by our IT security people, our IT security officer insisted that Moodle-login exposed to the Internet was secured with a Captcha as a defense against bot-attacks.
I programmed in Google Captcha 2 into Moodle 2.9 and I have updated my code for Moodle 3.2. A captcha should be a regulare feature of Moodle.
I responded to MDL-53368 by uploading my code. But MDL-53368 is about Moodle 3.0. I suggest the captcha as a regular feature from v. 3.3. The way I implemented it the captcha will guard ANY authentication module on the login page. I ran a course on my Moodle in November, none of my users complained about the captcha.