So why not switch directly to proof of work instead of hassling humans?
Because PoW would only slow the attack.
Bots networks are often malware running on infected machines, so there's no cost to the hacker.
Captcha is supposed to stop the attack altogether.
More and more botnets are being sold as a service. By that, I mean things like DDoS as a Service. So it's not quite correct to say there's no cost to the hacker.
Because part of the purpose of the captcha (or at least most of their uses on the modern web) is to ensure human time is wasted. It’s “proof of suffering” more than proof of work or proof of payment.