It requires a spam protector to be available and set up correctly. If any spam protector module is installed, the field will show - but doesn't check for a valid API key. In the case of recaptcha or akisment spam protectors, that means it won't apply any spam protection.
This affects the default CWP functionality with the recently added blog module, since it bundles the
silverstripe/akismetmodule but doesn't configure an API key. cc https://github.com/tractorcow|@tractorcow https://github.com/assertchris|@assertchris