This is done, and generally doesn't work as well. Your model will catch people using yesterday's cheats, but the cat-and-mouse nature of cheating means that people will adapt. Funnily enough, cheaters are also training models to play games so that they can evade cheat detection. The kernel-level anticheats are designed to prevent the game from running if they detect you are running any software that interacts with the game. Much simpler for the developer, and circumventing it usually requires running your cheats on a second machine which a) limits what you can do and b) has a higher barrier to entry.