Moderation is an ultra hard problem so yeah its gonna be difficult. Nothing can really be bulletproof in that sense. Most types of controls can get evaded in some way.
That's not to say that putting up some little hurdles won't help. It at least solves the problem of automated signups (temporarily) and low effort trolling. If someone runs a coordinated attack i think that's just going to be very hard to defend against.
Yeah, unfortunately we can't stop people from signing up automatically on other instances and flooding our communities. This will certainly be a pain as Lemmy grows, hopefully some automod tools are in the works - I am aware of an attempt to create a translation layer between Reddit API calls and Lemmy. Hopefully this will bring in some of the existing tools.
In the meantime, I suppose the best thing we can do is report problematic comments and posts so moderators can jump in. I think interacting with these people only gives them what they want.