But isn't all client-side anti-cheat bypassable by doing image recognition on the rendered image? (either remote desktop or a hardware-based display cable proxy)
Modern cheats are far more advanced than this. Using a DMA cheat, you basically just read the game's memory from a different computer and there's no way for the game to know unless the PCI device ID is known: https://intl.anticheatexpert.com/resource-center/content-68....
Nowadays if memory access is needed, you are looking at having to find a way to load a custom BIOS or UEFI module in a way that doesn't mess with secure boot. Even then, certain anti-cheats use frequently firing interrupts to find any unknown code executing on any system threads.