You're not thinking fourth dimensionally. Yes that's how it is now. But the majority of users aren't using PATs so if you want people using your website you have to provide a reasonable experience for unverified users. Once 99% of users are using PATs, you'd be stupid not to require them. Severely degrading (through captchas) or outright blocking unverified clients would be trivial. Hell, I'd wager firewall software will even show you these blockages as "blocked attack" or "blocked dangerous client" or something like that.