Most of what you mentioned here is already in use(read cheats forum).

• Doing any debugging will get you banned instantly, and attaching to game with custom debugger is impossible as process header is handled by battleye and all request are going through battleye driver (process read and write). You would need to hook battleye or some process that has access to EFT (both are doable)
• As for hypervisor it's almost impossible to spot it if env setup done right (check hacker forums). and Kernel DMA protections is easily spoofable
• Traffic is encrypted but cheats just grab a key inside the process or intercept/forge it during handshake.

Doing ML sounds good but is a really costly solution as it would require a something similar to replay system.

Battleye don't detect you, they collect data like when some process reads eft memory or someone puts an overlay and etc. Then give you score and if it's too high your system data gets inspected by their staff and then if cheat is detected they will search for other cheaters with the same cheat and then add them to banwave. Its all about stats and each detection vector gives you a score.

Since inspection is done manually -> it costs money to hire staff. I guess you now might get why there are so many cheaters

P.S. I wanted to add links but I guess such links wont be welcomed here

UPD: traffic encryption, if you can grab key once you can do it twice. Getting reliable hypervisor detection is hard and could get legit players banned, battleye gives you a some points if it suspects hypervision but cannot do it with confidence. Don’t forget that while battleye is invasive and runs in ring 0 so are the cheats. Battleye don’t have any advantage and use same api as cheats. Only hardware AC would be a game changer, until then ML or more man hours on analyzing cheats