I eliminated virtually all spam submissions on my site by using hidden fields and checking for common browser automation flags. I didn't want to use intrusive captchas if I didn't have to.
Last time I was laid off, I used my time to build a side project. While it hasn't grown to fully support me, it does provide a nice addition to my income.
If I worked in cybersec, I'd probably leverage my skills in bug bounty while I look for another position.
I've been using yt-dlp to download the cc transcriptions that yt provides. Not sure if that would work for you. There is a npm library to interface with yt-dlp from node. I think it's yt-dlp-exec