The security/cheating arguments are good cover for MS simply enforcing their IP rights.
You do lose a lot of features that way though, such as a reliable global ranking, since it would be easy to create a room with only your friends and allow eachother to rank up quickly.
It's also a huge coordination issue if you want to arrange a game of 50-100 players who aren't all total strangers to eachother.
But the alternative seems to be in stripping the ancient practice of gaming of its social functions and turning it into a faceless slot machine where the only goal is to win enough times to increase a mostly meaningless number on a screen.
It also allows you to effectively nullify recoil through custom scripts uploaded to it. It’s everywhere in multiplayer PvP games on console.
If people want to plug random usb controllers, this doesn't stop them. It just means that Microsoft gets to charge you for the adaptor rather than a 3rd party.
Valve seems to have done a pretty good job dealing with this in their games. Surely there exist more sophisticated anti-cheat mechanisms than "just ban third-party accessories"?
This seems like the kind of thing that is repeated so much because some people want to believe it, and most of the time I bet it's people who haven't played a Valve multiplayer game ever.
I will say, I think the biggest problem contributing to high levels of cheating is the move away from dedicated servers. I actually find that VAC is historically very effective at catching cheaters, but with a necessary lag between detection and bans -- and that lag used to be handled by server admins.
There's no way to prevent that from happening with software changes.