My captcha never protected against spam, only against laziness

A second spam comment sailed straight past my captcha, honeypot and rate-limiting. Why those layers only stop lazy bots, and the content-based filter that closes the real gap.