unfortunately we've already been targeted by a small scale DOS attack (or wallet attack?), and account creation on our most expensive model was the only way we could solve the problem for now :/

I've worked in the anti-bot space for a while. Friction to real users is a huge cost. I strongly recommend a better solution.