Because PoW would only slow the attack.

Bots networks are often malware running on infected machines, so there's no cost to the hacker.

Captcha is supposed to stop the attack altogether.