WooCommerce already ships a checkout limiter, and it is off
The Store API carries its own limiter, switched off out of the box. Turning it on takes one filter, and getting it right takes an accurate client address.
Where the classic WooCommerce checkout actually submits
The form is on the checkout page. The request that places the order is not, and anything wired to the page template never sees it.
Block checkout submits somewhere else: the Store API route
The Checkout block posts JSON to a REST route. Code hooked to the classic checkout is never asked, which is why protection can look healthy and do nothing.
WooCommerce captcha not stopping failed orders? Check the Store API path
A captcha on the checkout page only covers the request it is wired to. The block checkout places orders through the Store API, where classic checkout hooks never fire.