> How is "don't trust the client" an arms race?

Exactly. You write the game logic, you know what the client is and isn't allowed to do. Just ban/kick if the client tries to do something it isn't supposed to do.

The only thing stuff like EAC should be needed for is stopping people from delegating making their game logic legal inputs via an aimbot or some external script instead of their actual fingers, which doesn't seem relevant for VRChat.

Another reason for EAC would be a kind of cheat people built for a recent Battlefield game: a modded graphics driver that changed colors to make other players more visible. There's just no way to detect this server side.

That doesn't seem very relevant for VRChat, either.

>Just ban/kick if the client tries to do something it isn't supposed to do.

Of course couple this with a deep understanding of what your client actually can do. Oh, and keep track of updates you'll have a lot of banned users.

The "dead simple solution of appending a client ID" would completely fail if the modified client sent the Client ID of a supported client.

Correct. The problem is users not mentioning they have modified clients when reporting e.g. avatar rendering issues to individual modders. The users aren't being deceptive, they're just non-technical

Welcome to the fruits of a computing industry that hasn't focused on making computing more accessible cognitive load wise in decades.

Specs locked behind paywalls/licensewalls. Closed source API:s, lock in via cryptography... It all comes together to create just what large software platforms want, but what people like Engelbart were trying to avoid.

A technically ignorant/illeterate user populace.