The fact that if an entity uses thousands of bots, verification does become expensive. At the very minimum, it's an additional barrier. All else being equal, bots and sockpuppets are less likely to get verified than regular human users. I've seen communities where an individual user created dozens of sockpuppets to troll around. Such sockpuppets won't be verified for obvious reasons. Not to mention, if a credit card is used to verify lots of spam accounts, the card itself can be banned from being used to verify additional accounts, which hampers bad actors who have just a few credit cards lying around.