All major online game companies are moving towards kernel-level anticheat, as it's almost pointless to attempt anticheat otherwise.
Furthermore, more recently they have debuted VACNet, which uses machine learning, most likely to recognize certain patterns and behaviors associated with cheating. Probably still avoidable if one were to use subtle settings and knows how to act properly. But it shows they haven't given up and are trying to explore alternative methods at least. I'm admittedly not familiar with how successful it has been as I have not been playing or even following the game for a long time.
as a non-online gamer, what's so terrible about VAC? I had heard it worked pretty well (at least for counterstrike).
False bans cannot be appealed. They do happen. [1] You have no power to deal with them when they happen, and they really, really do happen. [2] You don't just get a game or server ban, you lose pretty much everything, and it becomes a public permanent record. Unless you're part of a headline, you have zero chance of reversal.
[0] https://help.steampowered.com/en/faqs/view/647C-5CC1-7EA9-3C...
[1] https://www.eurogamer.net/counter-strike-2-players-banned-fo...
[2] https://linustechtips.com/topic/1535786-valve-urges-amd-user...
VAC is designed around obscurity. When it detects a cheat it flags the account, and then an indeterminate amount of time later it/Valve bans all the flagged accounts. It makes it much harder for cheat devs to figure out what exactly flagged VAC, but the lack of an immediate ban means that normal players are still putting up with cheaters day in day out.
Another caveat is that VAC only bans you from the game engine. So you could get VAC banned from Counter-Strike and Counter-Strike: Source, yet still be free to hack on Counter-Strike 2.
Also considering how many of Valve's titles are free, there's no wonder why hacks are so prolific in their games.