There are definitely things that can be done to mitigate abuse. And in some cases close it off entirely. For example, only letting the client store info on what it can see is security 101 for online games. No hack/app/tool can get info that the client doesn't have.
SE's already doing that, though. Doing more than that is... tricky, admittedly. There's not really a reliable way to keep info the client does have out of third party app's hands and trying does just lead to the arms race you mention. But that doesn't mean they can't make it more difficult, like the OP's suggestion.