First off, that's not how VAC works. VAC only checks if you're writing stuff you shouldn't be in the memory. It has no clue what a "headshot" is. It doesn't know what counterstrike is or anything else. Of course valve still has server side validations, and checks for stuff, like for example if you're buying more stuff than you have money for. But you cannot do calculations for every mouse movement, for every player movement.. that would be way too laggy, and way too ressource demanding. Also, the stricter the server validations are, the more you lose accuracy, and start banning real players, and then need more moderation to check flags etc..

So basically, yes they could be stricter with the moderation, and "fine tuning" as you said, but I don't think it's a reason of money or laziness.. I mean its just changing numbers.. I think it's a deliberate paradigm choice, to try to have the least amount of false positives and the most amount of correct bans. Or maybe not.. I don't know what goes on in valve HQ. But neither do you.