It’s a lot of staff resources. Typically, software detects it, a CSR verifies it, and then the CSR gets two weeks of whining from the cheater and parent(s).
-Or the Valve way, where software detects injections or anything else pre-determined to be undesirable, and then a ban’s slapped down with appeals closed…