This is largely dependent on the passive collection capabilities of a particular anti-cheat. Sometimes getting a copy is useful to just to make 100% sure the detection you wrote works as intended. Sometimes it's because the techniques used are novel. Most anti-cheat vendors do this.

Not parent, but have seen this before, or some competitor/pissed off outed person/partner in crime/etc hands it to anticheat team.

Private cheats usually require being vouched in, sometimes with ID scans, sometimes physically shipping you hardware.