You're right - you can never prevent that. Which means your client needs to offer it to keep it from becoming an advantage. If the players are already bright, recognizable colours you're basically already there. Transparent walls don't help when the server doesn't send you the enemies hiding behind them until the very instant they pop out. And if you're only spoofing mouse movement, well, that is getting pretty high risk, you may have a slight advantage, but human players will still be able to kill you without too much to effort. And I think that's the main thing anticheat should be preventing.
Even all that still doesn't stop a very old type of cheats: aim bots. Even if the server only sends you information about enemies the instant they pop out, a computer will be faster and more precise to aim and shoot at this enemy than any human player could be. Add in some randomization and delays so the server can't easily differentiate the movements from a human player, and you're a mechanically world-class player. Doing everything server-side is not enough to prevent cheating.
Sure, but aimbots aren't as much of a problem if they have to aim like humans - which you can enforce. You can buy some advantage like this, yes, but not much if it's implemented correctly. Additionally if you can't detect a player behind you for example, you're still dead, doesn't matter if you aimbot or not. "World class player" perhaps, but only if your bot can really play as well as a human within the confines of the game - knowing which corners to check, knowing when to look behind you, where to be aimed at a given time, etc. Your bot needs to be a hell of a lot smarter than a bot that's just given all the data and has to do basic trigonometry to aim at their head - your bot has to think a lot more like a human and may even underperform many humans.
Ultimately no matter what you do, some small percentage of your players will cheat. Every major game on the market has paid cheats which fully bypass the protections available for it. It's better if those cheats can only buy them a little than buy them a lot. It's not worth investing a lot of effort in more than basic cheat protection, it is worth investing it in handling as much as you can server side and exposing as much as you can client side as that is something cheaters can't game.
An aim bot doesn't have to play all the game for you, it doesn't need to think. I don't know how it is currently as I haven't played FPS games in a while, but back in the day, there were aim bots that would just activate when a target is in sight and take over, aim and shoot.
Yeah, modern aimbots are a lot more advanced than that. Mostly in that they'll know when someone's anywhere visible to you and they'll aim straight at their head.
This sort of behavior becomes impossible. If they have to aim in a fairly human manner, they can still be killed by anyone walking up behind them for example. It may provide some bit of unfair advantage. But not nearly as much as is possible in many games today.
