They do a lot more than just that, but a lot of the process is kept confidential. There's a huge cat and mouse game between cheaters and the sites so they try all sorts of things including only using second tier moves, and even 'blundering' but only in winning positions such that the blunder doesn't risk the outcome of the game. Some cheaters also only use the bot in certain parts of the game. In the extreme case you might have very strong players who are cheating (like in a money event) using only the comp eval. So they don't have an easy job at all.

Here, for example, is one of the more well known and easy meta-indicators of cheating: Humans spend more time on difficult moves than on trivial ones. Cheaters will typically spend a comparable amount of time on a trivial forced move, and the start of an exceptionally deep combination. And an even bigger tell is that said exceptionally deep combo may be followed by a couple of forced moves, yet he will again take just about the same amount of time to play those moves.