[tomooot]

I'm not sure about the pirate copies, but weirdly, my Steam install had it set to 0, and it's quite a fresh install too!

It seems like yes most of the "slowhack" methods have been patched out, but knowing the demographics of the playerbase I wouldn't be suprised if there are some semi-secret 0days.

Honestly I wasn't aware of cl_filterstuffcmd being a thing, though when set to 0 it's still possible to change the settings it protects (motd_write,cl_filterstuffcmd,bind,unbind,unbindall,connect): I expect you could just run a command to create an alias containing one of those, and then run the alias, or include a malicious .cfg in the mod content and exec it remotely.