Because to establish the tunnel, you need to send some "handshake" packets to the server. Those packets are not encrypted and can be easily identified and dropped.
Which is why `shadowsocks` has become popular to bypass the GFW: it has no such handshake phase and hence cannot be easily identified.
...and when GFW has trouble stopping `shadowsocks`, it threatens the author of the software. GFW is not only the technology, which is easy to bypass, but also the system that average citizen cannot escape.