From a purely technical standpoint: normal (unprivileged) anti-cheat can only look inside the process its running on, kernel anti-cheat has access to the entire OS, is this correct?
Are there cases of cheating which unprivileged anti-cheat absolutely cannot catch? Or is it that kernel anti-cheat is just so much easier to implement.