It's simple, have servers that enforce no-mod rule, and have servers that don't. Even back in cs1.6 there was the concept of VAC enabled and non-VAC enabled servers. Hackers could go in non-VAC servers and hack to their heart's contempt.

You can have official servers that are safe from "harassment", and let people have their own "non-secure" servers they do whatever they want in. It's not that complicated.