It's because preventing that is hard for the server (lot of things should be calculated by the server) or needs something like Valve's VAC to ban users of known exploits. And knowing apps used to exploit require a lot of people to track them down.

[Linked Image from w3.the-kgb.com][Linked Image from w3.the-kgb.com]