In general, people sometimes ask this question about FOSS and security. Isn't FOSS bad for security, they say, since attackers can look at your code and find the holes so they can break in? What this assumes is that the holes are inevitable and obvious, and all anyone needs to break in is find them. It turns out that this isn't true, as many security-sensitive open source projects from OpenBSD to Mozilla Firefox have demonstrated. Security holes shouldn't exist; help from the community to prevent this is key. The hope that code will be more secure if we only keep it secret - otherwise known as "security through obscurity" - is a pipe dream.
How would that work? If I have the source code of Starcraft, I can turn on the "Make the whole map visible" variable, and there's nothing whatsoever that encryption can do to prevent that. With closed-source, as far as I know, Blizzard's constant patching makes cheating relatively uncommon on their own servers.
I have an example of OSS software with yet no cheater. Check out xonotic (www.xonotic.org), a heavily modified quake based shooter. They partly implement anti-cheat functionality by more or less shifting tasks from the client side to the server side, making e.g. wallhacks impossible. Also they use encryption for certain packages to prevent them from being tapered with. Aimbots are another thing, but I have yet to see one. I didn't really dig into the security features though, that is just what I picked up by casually browsing the forums...
I think that the solution is radical: I think that as much much time and effort should be put into making the binary unhackable as is put into the game. Ultimately, DRM(1) is a game, and a lot of programmers are addicted to breaking it anyway.
What's funny about DRM in the case of an online game is that it's actually a feature that customers would pay extra for, and a premium for quality DRM. Hopefully, we'll have good companies and groups creating it, and online games (whether given away or sold) will advertise and brag about what kind of DRM that they're using.
(1) I'm using the term DRM because I can't figure out a better term - but it's more like tamper management, isn't it?
Putting stuff server side might help - meaning it doesn't matter so much what client people are using.