Disclosure: I run a small paid email service, so I've been on the receiving end of this.

Q1: Google doesn't really have a whitelisting step. You get in by having SPF, DKIM, DMARC and a clean reverse DNS, and then reputation does the rest. Google Postmaster Tools lets you see how they rate you, but you verify that via a DNS record, not a CAPTCHA.

Microsoft is the one with hoops. If your IP lands on their block list (and new or small senders land there easily, sometimes without any obvious reason), the only way out is their delisting form at sender.office.com. You enter the IP, confirm via email, solve a CAPTCHA, and wait. We had to do this for both of our sending IPs. No human involved, no explanation of why we were listed in the first place.

So yes: Microsoft makes small operators prove they're human. Google mostly just judges you silently.

Q2: Microsoft's outbound servers won't solve anything. If you put a CAPTCHA in front of them, their mail simply won't arrive, and nobody at Microsoft will notice or care. The only "hoop" that works in that direction is greylisting: big senders retry properly, so temporary rejections get through. Anything interactive just breaks the flow.

There's no reciprocity. The big providers set the rules, everyone else complies.

To be clear, in this case the Cloudflare reverse proxy shenanigans that let them snoop in on traffic are not actually in use (after digging into how it all works, I'm going to add to the warning I have about that specific bit); so as far as I can tell it's mostly safe.
Could they change their rules and start snooping on emails they route at some point? Yes, and that's indeed a risk with this sort of company.
But yeah, this is somewhat a compromise; I tried to make it as clear as possible =)

Relying on an oppressive walled-garden corp like Cloudflare who sees all traffic is an instant show-stopper for me. If CF is necessary to keep it gratis, then we have to wonder how Cloudfare is profitting. As you say:

“That, and Cloudflare is itself somewhat of a tracking and analytics company; so you're never going to be really anonymous using this setup.”

I only read that far. But I have to say getting your own domain should be sufficient because some domain name services include gratis email forwarding. I don’t recall having a limit on the number of aliases but my memory could be off on that.

I just setup SPF, DMARC and DKIM.

Last time I checked, it was enough to send email to Gmail accounts.

But my disclaimer is that much of my social network has DeGoogled, so I wouldn't be the first person to notice if Google's rules changed.

Edit: there's vanishingly few organizations that accept email without SPF, DMARC and DKIM. My own email server doesn't accept it, by my own configuration. I get too much spam, otherwise.

I don’t go out of my way to send email to Gmail accounts.

Does that mean you allow Google to block you? Or that Google is permissive for you and does not require a CAPTCHA?

I personally will not go out of my way in the slightest. Running a mail server from a residential IP with no spf/dmarc/dkim ensures that MS always refuses my email and Google refuses it /most/ of the time. And I am fine with that. To be clear, I am not asking to change that. My question is political. I want to know what MS is putting small email operators through, when they are willing to send to MS recipients.

I would like to hear from a server admin who has had to solve a CAPTCHA in order to get mail from their server accepted.

I never had to do anything special besides standard Email security setup for any domain I run.

I don't go out of my way to send email to Gmail accounts.

But the requirements I've encountered from Gmail were just modern email server headers and such, as was already mentioned by sqw.

i would guess that publishing and adhering to mail security records (dmarc, dkim, spf) probably also helps.