Or the server could hide the data from the client that the client shouldn't be able to act on until just before that data would be seen by the client. (obviously with a slight tolerance for sending a bit extra that clients might need if lag rubber-banding predicts it might be revealed)

That isn’t really enough... that wouldn’t stop aim bots, for example.

Another option is to develop server side AI that can detect some non human behavior or behavior patterns that are cheats. It's not full protection but for sure more appropriate than putting rootkits on the client side.

oh that can't backfire at all *sarcasm

here is another idea: proper ranking of player abilities! crazy right? something so simple should be a day-one feature right? that would put all the hackers together and they could even compete in their own hacking league... 100% of clients satisfied!

now think about game companies failing to put that single feature to work correctly, what changes do you think a AI that detect human behaviour have or working well in that space? :(