I do think you're correct, but one particularly sticky issue is what you do with all the subtle cheats. Rather than developing an exploit with wall-clip, radar, auto-headshots and so on - all obvious to a human moderator - what if you make one that just lowers recoil by a smidgen, 20% or so.

If you're watching the game as a moderator you could never tell that's what's happening. Yet -20% recoil, especially for a competitive esports player, would be such a massive advantage as to make that player the best in the world, but a way that looks quite legitimate.

Wouldnt that be trivially detectable in the data by comparing the nominal recoil configuration, reported hitscan trajectories, and mouse input profiles?

Especially since the cheats need to be available somewhere, so the developers should certainly be able to get their hands on them to test...

I assume that the argument is that pros can compensate recoil to some extent (i.e. the game doesn't just add increasingly random offsets to the trajectors but actually moves the crosshair and you can move it back if you're fast enough). If so then a cheat only has to simulate sufficiently realistic inputs based on the pixel outputs of the game, which is practically undetectable if you do it on external hardware. The only advantage the game devs would have is a larger amount of data they can use to determine what passes as realistic. And how are they going to identify false positives?

Not when the inputs are all randomized, it's nearly identical to a real human recoil control

Can you give an example of some games that take that approach that it works for?

I'd also suggest that human moderation is definitely less consistent, and definitely less able to scale.

Nobody is trying to solve the halting problem in the kernel either. If a cheat runs as a kernel level driver, and anticheat doesnt you've lost the battle already.

CSGO and Overwatch come to mind. I watch a talk on the latter, how the devs transitioned and optimised their anticheat system.

It makes sense the cheat I wrote would run as admin. It's my PC after all. I also don't have access to the server in any meaningful way and modify other people's data, either. It's a good trade-off. Devs can also write arbitrarily good statistical analyses for the game. It's their responsibility.

The question is simple - is this person performing abnormally? Well, games gather tons of telemetry nowadays, and the harder-to-detect cheats like wallhacks or fluorescent player textures are also the least useful. I am a hard silver I in CSGO. With or without aids, when I see someone run around the corner, I'll duck and magdump. Any gold nova will overpower me either way.