Making some assumptions here but I suspect most game developers outsource their anti cheat to a 3rd party and that is what you are running into. Some of the 3rd party anti cheat rootkit computers. Some are okay and some are just terrible.
You're correct, most companies don't make their own anti-cheat. We have categorized the different anti-cheats and have ways around them where needed. But whether or not the game devs or some 3rd party makes the anti-cheats it still leads to the same problems, I'm blocked from fixing their games on our hardware. I can't/won't share to many details about or internal process.
1) We're dependent on external tools for capturing and debugging shaders, most of which are detected as debuggers by anti-cheat and will kill the process before we even have a chance of reproducing the issue.
2) The other thing is driver signing, our solution use to be just production sign drivers and test with those, but Microsoft didn't like that we could sign as many drivers/dll as we wanted every single day. So they limited us to X per day and told us to use Test Signing which anti-cheat still detects and blocks. We have other methods too, but they're all slowly being detected by anti-cheats.
Guess, but GPU drivers have been known to change shaders being sent to the GPU for certain games, to fix things and increase performance, it's possible this could be detected as some kind of cheating by the anti-cheat.
Good guess, but most games don't actually look for that. The closest I've seen is them saving off the final rendered image and checking for wrong information. I think Vindictus was one that did that (learned about that outside the job so I have no issues sharing that.) I believe they mainly used it to detect cosmetic mods that might cut into their profits.
We only really replace shaders to fix issues that the game devs won't fix, and only then when the game isn't updated very often since it has a high chance of breaking our patches. On top of that I don't believe there is a good way to pull the information back from the driver in a reliable way, so it would be very hard to rely on any information that comes back from the driver.
