> An additional benefit is that this can include multiple cheat programs and versions in one ban wave, so it may be harder to narrow down exactly what the flaw was.
That seems like it could go the other way. There are five cheat programs that each have a dozen versions and now you know that everybody using program A and D got banned, the people using program C and E didn't, and the people using program B got banned but only if they were using version 1.2 or lower and not exclusively version 1.3 where they added a new anti-detection method that A and D don't use and C and E do. Now they know what to do.
Whereas if you ban them as soon as you can detect them, the people using program B get banned before version 1.3 is even out, they have to issue all of those refunds immediately and stop getting sales because their cheat stops working now instead of months from now, and then version 1.3 may not ever get released. Now all they know is that C and E are doing something the others weren't, but that could have been any of a dozen things so A and D don't know what to change.
Doing it that way also has another major problem: Suppose you do the ban wave. Do the people using the existing known detectable cheats now get to make new accounts and keep cheating? If you ban them again right away then the cheat makers get to keep making variants until that stops happening, but if you don't then the game is back to being full of cheaters the next day and the cheat makers are still making money selling the old detectable cheats to fund the development of undetectable ones.
Yeah that makes sense, if they collaborate and share information. But more-so it avoids the case where a patch drops then people suddenly get banned - it's easier to match the exact version and what changed or is different compared to others on the market that avoided it, which I think they want to avoid most.
I think ultimately it's to avoid devoting too many resources to the arms race by breaking it up into sprints. Mass ban waves also make community impact and news, and in some cases for the regular players it refreshes the scene just for a bit by clearing the muck. They can time it to coincide with in-game events or updates too then (which often break cheats), giving a window for non-cheaters to enjoy.
That seems like it could go the other way. There are five cheat programs that each have a dozen versions and now you know that everybody using program A and D got banned, the people using program C and E didn't, and the people using program B got banned but only if they were using version 1.2 or lower and not exclusively version 1.3 where they added a new anti-detection method that A and D don't use and C and E do. Now they know what to do.
Whereas if you ban them as soon as you can detect them, the people using program B get banned before version 1.3 is even out, they have to issue all of those refunds immediately and stop getting sales because their cheat stops working now instead of months from now, and then version 1.3 may not ever get released. Now all they know is that C and E are doing something the others weren't, but that could have been any of a dozen things so A and D don't know what to change.
Doing it that way also has another major problem: Suppose you do the ban wave. Do the people using the existing known detectable cheats now get to make new accounts and keep cheating? If you ban them again right away then the cheat makers get to keep making variants until that stops happening, but if you don't then the game is back to being full of cheaters the next day and the cheat makers are still making money selling the old detectable cheats to fund the development of undetectable ones.