[OliveMate]

Most anti-cheats will immediately kick/ban someone from a game if it detects certain applications or hooks. Good for removing cheaters, but that gives cheat devs immediate feedback that something in their cheat has triggered it – they'll modify the cheat, try again, then see if it's detected or not.

VAC is designed around obscurity. When it detects a cheat it flags the account, and then an indeterminate amount of time later it/Valve bans all the flagged accounts. It makes it much harder for cheat devs to figure out what exactly flagged VAC, but the lack of an immediate ban means that normal players are still putting up with cheaters day in day out.

Another caveat is that VAC only bans you from the game engine. So you could get VAC banned from Counter-Strike and Counter-Strike: Source, yet still be free to hack on Counter-Strike 2.

Also considering how many of Valve's titles are free, there's no wonder why hacks are so prolific in their games.