None of the verifications/permissionless social graph/historical chain activity stuff stop sybil attacks, they just make it more expensive and slightly less likely.
If facebook and every web2 platform which have mountains of device metrics can't stop sybil attacks, then web3 platforms which don't even have access to those same metrics have even less chance of doing so.

In any case, at a certain scale, "sybil attacks" really just ends up being real users that are so low quality/effort that no one wants around. The world has 8 billion people in it.

Sybil attacks remain a challenge in both web2 and web3 platforms. At scale, the focus shifts to user quality over quantity. Quality engagement is key in a world with 8 billion people.