Server-side anticheat is more complicated to implement, so companies go with the lazy client-side rootkit instead
Server side anticheat also requires trusted servers.
A lot of games are mostly P2P with minimal stuff actually happening on their own hardware.
Server side anticheat is mostly implemented in all popular games. An aimbot however can’t be detected on the server side, it could just be a user moving their mouse perfectly. There’s lots of client cheats like that, which is why clientside detection still makes sense.
You should read about statistics. An aim-bot will be consistently accurate, humans are not consistently accurate. If your aim-bot is purposefully inaccurate then it’s useless. Long story short, your cheating has to be indistinguishable from human, which is HARD to accomplish, and if you do you’ll lose 50% of the matches against other humans.
Not to mention a game with server side anti-cheat could purposefully send fake data, e.g. send a position for an “invisible” enemy, if you aim/fire to it you get tagged. It can do lots of similar stuff that would make the aim-bot less accurate than a human, e.g. every time an enemy enters line of sight add another enemy just outside of the frustum culling, or send an enemy behind a wall that has no visible parts. Cheaters will act on that information, regular users won’t. At that point the only way to bypass that is with external hardware that acts on the same information an actual user does (which also bypasses client side anti-cheat anyways), at that point you have a robot playing the game for you and losing 50% of the battles…