The point of Turnstile is to sell a warm fuzzy feeling of security to website owners, block Tor users who don't enable JavaScript, and convince website owners to give a copy of all their traffic to the NSA for free.

Actual security is barely relevant except to the extent that if it doesn't add any security, the NSA might get worried that people will stop using Cloudflare.

Fake security - number of blocked users, which Cloudflare calls "bots" regardless of whether they're people or bots - is used in Cloudflare marketing.