If Discord or Roblox suspect that your account is a bot, or you have a "suspicious" IP address, they do present you with a hCaptcha challenge to log into your respective accounts to access the OAuth system in use.
These "preventative" measures however are entirely useless when the companies which design them allow you to gain Accessibility cookies which bypass the need for completing any captcha challenges.