The exercises are dependent on what researchers are paying for. The spammer needs to keep up. Which they can do by sampling hCaptchas and figuring out what tasks are being done.

The question is how much value spamming provides. If it's significant, then it pays for the arms race. Given the investment in beating reCaptcha, it seems that spam provides high value.

Edit: And! And! hCaptcha could become victim to a malicious bot that feeds bad data into other researchers' training sets. The bot would need to reply to an overwhelming number of hCaptcha captures, such that it becomes the dominant validation set. It would be a self-fulfilling model. It'd even be performed at the expense of the legitimate researchers, who must pay ethercoin for every hCaptcha response. Much like cryptocurrency networks, hCaptcha is susceptible to a cartel. In this case, it'd be a bot-cartel, feeding bad data. Humans could be locked out, as hCaptcha might be convinced the humans are bots and the bots are human.