What is missing or needs to be updated?

The Credential Stuffing Prevention cheatsheet has a section on CAPTCHAs, but it could have a little more information about more modern CAPTCHAs that don't depend on the user solving some kind of text or image puzzle but rather make the device do the work (ie, through a proof-of-work challenge).

How should this be resolved?

Resolve by extending the CAPTCHA section to include information and advice about modern CAPTCHAs.