Turnstile still a click, and that click is already exploited for phishing (note that Turnstile is also called CAPTCHA on the following site, though you are technically correct):

https://www.techradar.com/pro/security/fake-cloudflare-captc...