The same paper puts it really well too (see image attached). Now sure, aimbots will still reign supreme, but then you wonder how wallhacks are a thing because the client shouldn't have an idea about a player across the map, but he does somehow anyway (bad coding, but it's also hard, I understand)
It happens especially for big games because there is an incentive to write cheats for them in the first place. Look at CS, COD, Apex etc. there are a lot of cheats and cheaters and seemingly nothing they can do against it. Meanwhile Cheatdevs stopped writing cheats for BF 2024 (the latest Battlefield) because the player count was too low. Now what most games do is use something like EAC or Battleeye that scans your PC for cheats, which is generally built into the client. Game dies? Now they have to remove it. With what dev resources? Yeah...
The bigger issue for games in general (especially SP) are services that are required to play the game, which means that when (not if) hose go away mean that you can't play the game anymore. Player data stored on a server instead of locally (because microtransactions, remember the days of editing save files?), Games for Windows Live, GameSpy, etc.
From anecdotal evidence game devs just rely on clientside AC and do zero checks on server side because rarely do mp servers catch rather obvious cheaters (high KD/headshot rate, insanely fast movement, unlimited ammo etc.)