It ultimately boils down to a cat and mouse game. What you end up with are extremely intrusive anticheat tools that do all sorts of nasty Trojan-like things; for example, injecting DLLs into a player's host machine to determine if they have modified the memory of the game.

The anticheat process itself will hide and run in kernelmode. I don't know about you, but I don't feel terribly comfortable having a closed source binary running in ring0.