The game that became 1.6 wasn't even their game. It was a mod for the original Half Life and they hired the modders after it got popular.
Then CS:Source came around the same time HL2 did. That is to say it exists only because HL2 did, and Source is just HL2 with guns (lol). It was very divisive in the pro scene and the majority of professional players rejected it.
GO's history is even worse. It wasn't even meant to exist at first; Hidden Path were porting CS:Source to consoles and Valve decided that it could live as its own game. They release it in 2012 and, by all accounts, it sucks. Nobody plays it. Things begin to change when they create a virtual economy (skins) and admittedly do actually improve the game a fair bit. It's only when the game sees those improvements (2013-14?) that the pro scene finally moves from 1.6 to GO.
So the situation in 2021: The most popular game on Steam is a game which, according to Valve themselves, shares 75-85% of its code with a game released almost 20 years ago (Half Life 2), and which everybody knows is a complete and utter mess under the hood (thanks in part due to the source code getting leaked, also thanks to ex-devs sharing their stories of their time working on CS:GO). This along with Valve being notorious for just not having the internal incentive structures to get bugs fixed (hence GO's spaghetti code)... it's easier to understand (but not excuse!) Valve's attitude for serious security flaws like these.
I am similar to you in that I have about 1000 hours in CS:GO, and I've spent many 1000s of hours watching the pro scene. I love Counter Strike, but with Valve the way it is, I don't see how these fundamental flaws will ever get fixed. Look at how they're allowing Valorant to decimate the North American CS scene, just like they allowed Overwatch to take from TF2's player base back in 2016.