The problem is that for detection of identical programs, vac relies on program signatures. You could make slight changes to to program to change the signature and recompile it, or use something that changes the signature every time you compile it. That means even though those running the cheats are using essentially the same program sold to them by the same person, if one gets banned then VAC sees the other program and goes, “I’ve never seen this program in my life”
Other anti cheats will try to identify programs by their functionality (e.g modifying or reading memory of other programs) and using heuristics but that is both more invasive and requires higher level of privilege which many people aren’t willing to give.
The other alternative valve is experimenting with is AI to detect aimbot, which could work in some instances, but is prone to false positives, and isn’t able to as easily identify behavior such as walling