CAPTCHAs works primarily by means of economics. Most image CAPTCHAs have been broken in general; it's just usually not worth to break particular ones for any but the biggest sites. Breaking many - if not most - image CAPTCHAs is almost a textbook image processing exercise; those that are too hard can be outsourced to people (through e.g. "solve the following CAPTCHAs to access pornography"). Google's CAPTCHA now moved from image recognition to estimating your humanness by using God knows how much data they collect on your browsing - it works, but comes with obvious privacy-related trade-offs.

I feel the war against synthesizers will be over as soon as someone open-sources a good enough one, or at least starts selling it relatively cheaply.