[Spivak]

Because the preferred deployment method of a lot of these cheats is via drivers so they look transparent to the game and are harder to detect from a userspace application.

[krageon]

The preferred deployment method of real cheats is outside of a virtualisation boundary. Driver-based is essentially entry level.