Theres plenty of what you suggest going on all the time, loot spawning in unlootable places etc.

Problem is, theres always some difference between valid and invalid target, and if the game knows it, cheat extracts that information and acts "dumb" around those honeypots. It wont shoot targets that the game doesnt render because the bot checks that attribute. It wont loot that honeypot because its in manualy upkept white/blacklist.

Its just another level of cat and mouse game.

Yep, the cheat engine designers get thousands and thousands of test cases. If the designer screws up your account gets banned, but quite often they can detect what did it.

Now, good cheat detection won't ban you immediately, it will allow you to build up a novel of sins and then ban so it's difficult to determine what action provoked it. Unfortunately that does mean those people are on the servers for some amount of time.

> theres always some difference between valid and invalid target

This information does not necessarily need to be made available to the client. Latency compensation can treat the phantom just like the real deal and the server can silently no-op any related commands (while recording your naughty behavior).