While VAC is indeed far from competent at detecting all but the most rudimentary cheats, it is so by design. When the first third party CSGO matchmaking/league services decided to use kernel level AC, Valve publically said they would personally not do such a thing. I can't remember if any exact reasons were named at the time, but I do think it's a fair take on their end. It's not like they're locking developers into using VAC anyway.
Furthermore, more recently they have debuted VACNet, which uses machine learning, most likely to recognize certain patterns and behaviors associated with cheating. Probably still avoidable if one were to use subtle settings and knows how to act properly. But it shows they haven't given up and are trying to explore alternative methods at least. I'm admittedly not familiar with how successful it has been as I have not been playing or even following the game for a long time.
"VAC bans are permanent, non-negotiable, and cannot be removed by Steam Support. If a VAC ban is determined to have been issued incorrectly it will automatically be removed." [0]
False bans cannot be appealed. They do happen. [1] You have no power to deal with them when they happen, and they really, really do happen. [2] You don't just get a game or server ban, you lose pretty much everything, and it becomes a public permanent record. Unless you're part of a headline, you have zero chance of reversal.
Most anti-cheats will immediately kick/ban someone from a game if it detects certain applications or hooks. Good for removing cheaters, but that gives cheat devs immediate feedback that something in their cheat has triggered it – they'll modify the cheat, try again, then see if it's detected or not.
VAC is designed around obscurity. When it detects a cheat it flags the account, and then an indeterminate amount of time later it/Valve bans all the flagged accounts. It makes it much harder for cheat devs to figure out what exactly flagged VAC, but the lack of an immediate ban means that normal players are still putting up with cheaters day in day out.
Another caveat is that VAC only bans you from the game engine. So you could get VAC banned from Counter-Strike and Counter-Strike: Source, yet still be free to hack on Counter-Strike 2.
Also considering how many of Valve's titles are free, there's no wonder why hacks are so prolific in their games.
