Because PoW would only slow the attack.

Bots networks are often malware running on infected machines, so there's no cost to the hacker.

Captcha is supposed to stop the attack altogether.

Because part of the purpose of the captcha (or at least most of their uses on the modern web) is to ensure human time is wasted. It’s “proof of suffering” more than proof of work or proof of payment.