It's actually really hard to distribute a cheat to a lot of people without it getting flagged.

Yeah, let me clarify my argument there. Open source, safe, well-known clients, mods or modding systems can easily be monitored for workarounds and flagged, and become unviable. Malicious actors with second intentions however can keep finding new exploits and releasing small, obscure, harmful software that has way less exposure because the vast majority of people are not interested in harming anyone, they just want their mods to do something minor like displaying screenshots in the loading screen or adding support for eye tracking. They will not seek these out. These will be sold (financial incentive) or used by people with too much time on their hands and an axe to grind.