Mostly when it comes to the types of papers I read them being shoddy involves issues of the type "yeah this has good asymptotic performance and even the constants are good but we're completely thrashing caches and to get it published we cherry-picked the algorithms we benchmark against so we still come out on top, or near the top but can say that our way to do things is simpler". Or even better "let's not do benchmarks at all but overload the paper with Greek and call it theory in the hopes nobody ever tries to implement it".

And I'm not even blaming people for it, the issue being that these kinds of results should be published for the sake of science and not having to duplicate work but people need to jazz it up to get their papers accepted. The metric for "contribution to the field" is fucked: It was a valiant effort, it didn't really pan out, can't hit the target without missing a couple of times first and with each try you learn and so did I from reading the paper. "Algorithm doesn't actually produce the output it's supposed to produce" is virtually unheard of, at least in a fraudulent manner. It's after all much easier to get things to be correct than to get them to be fast.

This paper isn't your usual CS paper though, "having humans do stuff and analyse what they did and what they think of it" isn't exactly a CS methodology, what happens in those cases is that researchers ask for help from a random researcher down the hallway working in a field which uses suitable methods. Peer review at USENIX won't check that methodology for sanity because the peers there have no real idea either.

As to the novelty of the claim: Pretty much restricted to "this annoys humans more than it annoys bots". That captchas can be beat by bots is well-established in the field (both in the "academic" and "wearing a BOFH t-shirt" sense), that they're annoying is so painfully obvious only psychologists would dare to challenge it, so the claim is indeed restricted to "have they lost 99% or 110% of their value when you value the sanity of your human users".