Yes a captcha would certainly be good for thwarting bot activity. I don’t require frontend login right now but it is a fact that the modification will cause a problem for frontend users.
A benefit of hacking wp-login.php is when I switch themes the function is still active, otherwise I will need to remember to place it in each theme’s function file. Being made as a plugin would solve that though.
