Not the case in my experience. Nobody is backing out from server-side checks and nobody is spending a ton of money either developing or purchasing anticheat to appease “non-technical stakeholders”, such as they are.

Riot Games is a perfect case study where this exact thing happened, IMO.

League of Legends had millions of MAU and a near zero incidence of cheating, for a ~13-14 year span. They implemented root-level AC for their next game, Valorant, and they ran into aimbot problems within weeks. Root-level AC was rolled out for League a few years later, despite vocal objections from their developers, several of whom were vocally against the move on r/leagueoflinux.

Overwatch is another example of a super-popular game that manages to stay cheater-free using only heuristics and player reports. They’re doing dramatically better at stamping out cheaters than Valorant, CoD, and other comparable games that include root-level AC.

Are there any counterexamples where you’ve seen a game struggling with cheaters fix the issue with root-level AC? I can’t think of any, but maybe my gaming pool is just too narrow.

Rendering on client means you can still do all sorts of crap in terms of wallhacks, spoofing inputs and so on.

The solution for this that’s now in vogue is server-side occlusion checking. Basically, map what objects/characters that player has line-of-sight on server-side, and send the client only data for those which are visible.

Could you do effective autoaim with just a rendered frame fast enough? I bet somebody would try.

This exists - it’s usually done with a microcontroller that intercepts the monitor feed, scans nearby the player’s cursor or center-of-screen for probable targets, and softly fuzzes mouse movements towards that target.

Hell, in some cases the cheating isn’t even on software these days. CS had a big argument about some keyboard behaviors recently, as did fighting games about leverless sticks enabling certain shortcuts.

Yep, 100%. That’s why root-level AC is a bad option: cheaters are just switching over to these out-of-band techniques.

Companies prefer root-level AC because it gives non-technical stakeholders the impression that a game is “cheat-proof”, and therefore, that they don’t need to fund customer support to monitor and review reports of cheating. They’re not using root-level, client-side AC because it’s more effective than alternative options.

at least with running nothing but the renderer and the controller input client-side

Nearly all competitive multiplayer games run this way. The client is an untrusted rendering service, while the overall state of the game world is tracked server side.

I agree with your overall point.

However, as a professional codemonkey, I promise you that root-level AC is in fact less secure than server-side heuristic AC + user reporting, and tends to be user-hostile due to false-flagging of modified systems. Root-level AC can be bypassed rather easily these days with DMA and other out-of-band tooling.

As a case-study, League of Legends lacked any root-level AC for well over a decade, and was arguably the most popular game in the world at points. Cheaters were extraordinarily rare; the average player would typically encounter well under a dozen cheaters per thousand games.

Riot Games then released Valorant with full root-level AC, and had an aimbot explosion within a few months - mostly because they devalued player feedback & reporting in favor of their “robust” automated AC solution. Their overall anticheat strategy became less reliable on the whole, but they stuck to it because root-level AC is cheaper and easier to execute from the corporate-profit POV.