With a token, you probably get a higher efficiency. Similar to how a heatpump is more efficient than a heater.

If you only consume resources on the client side, then you hope that an attacker thinks "I won't invest $0.01 of resources just to log in here".

If you also transfer the consumed resources to the server, you get an additional benefit: The server thinks "$0.01 is enough to cover the costs of a fake signup".

And the second benefit is probably even better than the first. The server will never really know how cheaply attackers can access resources. But they probably know how much a fake signup costs them.