Maybe you didn’t declare ‘captcha’ to be safe (a.k.a. defined a rule for it)? Other than that there’s no reason why you should not be able to access this attribute in beforeValidate.
Basic rule in coding: Anything that works is right - at least partially.
I guess you have a chicken-egg problem here: Validation rules (and in last consequence ultimately: scenarios) define, which attributes are safe to be massively assigned. On the other hand you want to decide in beforeValidate, which scenario to use, based on the assigned value for ‘captcha’.
So checking ‘captcha’ manually in POST should be fine here.