Nearly every anticheat system already does this. The thing about anticheat teams is, they almost never talk about how their systems work, but I can practically guarantee to you one thing: There is no idea you could have which has not been tried in the war against cheaters.
CounterStrike has, in times past, probably also today, used where you're aiming as a signal for whether you're using wallhacks. Like, if you're aiming and trailing directly on top of another player, but through a wall, for extended periods of time. This is statistical modeling.
> And triggering that would require some sort of skill verification
How do you remotely validate the skill of someone who is possibly cheating? Why wouldn't they just cheat at the validation? Do you, maybe, accept that they may cheat, but then raise videos of their skill checks to an enforcement team for validation? CounterStrike also already does this! They have the Overwatch system which enables specially trusted players to review gameplay footage of other players which VAC suspects of cheating.
Now, Runescape is the most explicit example of these "skill checks" I've encountered. Certain undocumented behavior which resembled botting could trigger an in-game "captcha" where you had to prove you were human. If you were, you'd often get a prize. Simple. Somewhat effective (often, people would just get around this by paying cheap labor in third world countries to oversee a hundred bots per person, and solve the captcha events when they happened. they did not save Runescape's economy from being destroyed by bots, and eventually, the game began enforcing strict value-for-value trading rules between players).
What are CounterStrike and Runescape infamous for? Cheaters and botters, moreso than most other games.
Statistical methods are a tool in the toolbox of anti-cheat systems, but they're not enough alone. They're far, far too easy to defeat; when a metric becomes a goal, it ceases to be an effective metric. If I keep a wallhack on for an entire game, it becomes very easy to detect; If I turn it on for just one kill, that one kill which puts us on the winning side of a tie, and I'm victorious, the outcome is similar, but I'm far harder for statistical modeling to catch.