[oliwarner]

Because many cheaters do things which are impossible. This is low hanging fruit that we're told we need a ring0 driver to have access to EVERYTHING. Stupid things like tracking other players through walls. Still common because it's so damned easy. You play back their events and you see the cheater always knows where to go, where to hide. There are also exploits. These can all be unit tested away.

But there are cheats like kickback compensation, hitbox tracking. You can apply statistical models and find unlikely consistency but it's hard to say for certain.