I think there was a time that was true. Now reCAPTCHA is so prone to tagging someone as a bot if they employ any ad blocking or tracking prevention that it significantly interferes with web use. It's an overall harm to the web in my opinion.
AFAIK attackers only need to actually access your content once and extract the ad embed. Please correct me if I'm wrong.