The problem is that they cannot detect every program. Without checking your machine for all the processes running -- which is not looked kindly on by privacy advocates in general, and verges on illegal in some places -- they're going to be unable to determine that you're running a specific program save by looking for certain tells. Stuff like, are the keyboard presses coming solely through key events but not if they double-check via DirectInput, or whatever? Is someone in their house for 2 hours straight with only movement, no actions used? Etc.

And as soon as they find one way to detect the tools, some jackass is going to come up with a new method and the devs have to go right back to figuring out how to detect that.

Even without the software problems, you could have someone out there who'll come up with some convoluted method like using a little robotic arm to waggle the joystick around and make them run around a marketplace jumping like a lunatic, thus being indistinguishable (from a software standpoint) from an actual player waggling their controller joystick around and jumping like a lunatic.

And if you think "moving a joystick around with a robotic arm is way more effort than anyone would go to"... I mean, someone made an adapter to let them play AST cards by drawing cards from a Yu-Gi-Oh card device, and the same person wrote a dancer interface where you could trigger your dance steps via computer vision by dancing in real life in front of a Kinect camera. Heck, I myself wrote a thing that let me use my actual MIDI keyboard as an input for Bard performance mode, largely because I wanted to see if I could come up with a feasible way to generate psuedo-chords on-the-fly when I pressed multiple keys on the MIDI keyboard.

(For the record, I could not, at least not in a way that didn't sound horrible. Alas.)

People are resourceful and do crazy stuff just for fun, even without it being because they want to circumvent the AFK timer.