What each WooCommerce order status actually claims
Eight labels, and most shops use three. Failed is a decline rather than an abandonment, and draft exists only because of the block checkout.
WooCommerce already ships a checkout limiter, and it is off
The Store API carries its own limiter, switched off out of the box. Turning it on takes one filter, and getting it right takes an accurate client address.
Block checkout submits somewhere else: the Store API route
The Checkout block posts JSON to a REST route. Code hooked to the classic checkout is never asked, which is why protection can look healthy and do nothing.
WooCommerce captcha not stopping failed orders? Check the Store API path
A captcha on the checkout page only covers the request it is wired to. The block checkout places orders through the Store API, where classic checkout hooks never fire.