Many programmers have no idea how a CAPTCHA is supposed to work. It never occurs to them to think though how someone would break it. Someone tells them the client wants a CAPTCHA, they go "oh yeah, that's those weird letters on the screen", and are probably pretty proud of how they did it.

Don't believe me?

Think about how often you see obvious SQL injection problems - the same (lack of!) thought process is responsible for both.