Exploits aren't allowed. If a bug isn't considered an exploit and isn't explicitly against the rules they are fine to use them.
I can see how leaning into exploits for competitive can ruin the noncompetitive community, and later take out the competitive one that feeds off this community. I used to play chivalry: medieval warefare, which was a lot more fun of a game before the competitive community figured out the frame perfect meta and ruined the game for everyone else who doesn't have hours and hours of free time to throw at practicing the metagame alone, which is most gamers I imagine.
Yes, bugs are used competitively but communities will often come to consensus on which bugs are allowed and which aren't.
I think for the most part when you see a bug it's easy to tell if it'll be acceptable for competitive use. Bugs that allow enable more counterplay or raise skill ceilings are usually fine. Bugs that give you an unfair advantage or go against the spirit of the game are usually not.
FWIW I think bugs in the latter bucket should be fixed asap. While you can forbid exploits in a tournament, these kinds of bugs can ruin ladder play.
Following the rules doesn't get you very far when cheaters don't get punished.
Basically, I think you're letting Valve off the hook. Sure, the competitors shouldn't cheat, but Valve should also make sure they create an environment in which cheating isn't incentivised. In the world of software, a few years is a long time. Leaving a known bug that gives a massive competitive advantage unfixed for that long borders on negligence, especially when the fix is relatively trivial.
Yes Valve could do a better job at supporting esports. But there will always be in-game exploits as well as out of game methods to cheat so ultimately it is down to the individual participants to cheat or not.
Also these tournaments are run by third parties on third party servers. Valve isn't even involved except for a small role in the once a year majors (that haven't happened for like two years now). So saying this isn't enforced just because Valve didn't fix a bug makes no sense because Valve isn't the company that enforces these things anyways.
This is not true. Once the exploit became known, Valve released an update same day.