In particular, while using a VPN or Tor. So in one sense it’s even a pro-privacy move, insofar as it allows to distinguish a human user on a legit device using a VPN from a bot using a VPN (upon which the server can present a captcha or denial to the latter, but not the former, making it less onerous for average users to use a VPN).