If I remember, Askimet (anti-spam plugin) is included by default. Captchas for blog spam are usually a bad idea anyway, IMHO, because blog spammers are generally not targeting specific blogs, so even the smallest of obstacles is usually enough to make a spammer go somewhere else. Captchas just add an extra obstacle for the commenter.

Edit: just noticed that Askimet is only free for personal use, so I guess it doesn't help everyone that it is included by default.

Edit 2: by the way, I agree about the plugin menus.