Captcha allow to guess passwords

This can be fixed by altering CAPTCHA enabled forms

function mymodule_form_alter(&$form, &$form_state, $form_id)
{
  if ( function_exists('captcha_get_form_id_setting') && captcha_get_form_id_setting($form_id) )
  {
    $form['#validate'][] = '_mymodule_hide_errors';
  }
}

function _mymodule_hide_errors(&$form, &$form_state)
{
  $errors = form_get_errors();

  if ( !empty($errors['captcha_response']) )
  {
    // Original error message
    $captcha_error = $errors['captcha_response'];

    // Clear all errors
    form_clear_error();

    // Clear all error messages
    foreach ( $errors as $error_message )
    {
      if ( ($key = array_search($error_message, $_SESSION['messages']['error'])) !== FALSE )
      {
        unset($_SESSION['messages']['error'][$key]);
      }
    }

    // Set CAPTCHA error again
    form_set_error('captcha_response', $captcha_error);
  }
}

I guess this is the related issue for the Drupal 8 version: #3202776: [PP-1][2.x] Do not execute other form validations if CAPTCHA is wrong
Would still make sense to fix this, if anyone is interested to provide a fix. So CAPTCHA doesn't introduce a security risk here, I guess, but doesn't require a valid response to check if the password is correct?

Still #3 looks super dirty to me ;)