The reason there are so many cheaters in GTA Online is because people can buy a new account from G2A or similar sites for a couple bucks.
It's a lot worse than that: a key problem is that GTAO's netcode is an absurd mess of bad practices that should never have made it to production, let alone been allowed to sit unaddressed for seven years. It's not just client-authoritative and P2P: every client just naively trusts everything any other client sends, and somehow the report feature is also tied into the P2P networking so your client has to tell the other clients "hey I'm reporting you, that's ok right?" and the target can just say "no u", block the report, and autoreport you instead. The same thing goes for votekicks: they rely on the targeted player's client to obey and leave, and also don't rely on a consensus from connected players so a single client can just send the "lmao you were votekicked" message to yours and your client will politely disconnect you from the session. It's just mindboggling how poorly designed it is from a security standpoint, where there's just absolutely no sanity checking of inputs to make things like forced teleports or kicking you from your own organization impossible. Rockstar doesn't even play whack-a-mole with it to target specific exploits the hacked clients use, they just ignore the problem completely.
It's a lot worse than that: a key problem is that GTAO's netcode is an absurd mess of bad practices that should never have made it to production, let alone been allowed to sit unaddressed for seven years. It's not just client-authoritative and P2P: every client just naively trusts everything any other client sends, and somehow the report feature is also tied into the P2P networking so your client has to tell the other clients "hey I'm reporting you, that's ok right?" and the target can just say "no u", block the report, and autoreport you instead. The same thing goes for votekicks: they rely on the targeted player's client to obey and leave, and also don't rely on a consensus from connected players so a single client can just send the "lmao you were votekicked" message to yours and your client will politely disconnect you from the session. It's just mindboggling how poorly designed it is from a security standpoint, where there's just absolutely no sanity checking of inputs to make things like forced teleports or kicking you from your own organization impossible. Rockstar doesn't even play whack-a-mole with it to target specific exploits the hacked clients use, they just ignore the problem completely.