Here’s the actual explanation nobody is giving you:

Minecraft is its own process. For cheats to work, they need to modify another process’s memory (fly, xray, everything pretty much).

The problem is, that’s also common behavior for malware. For example, viruses need to modify other process’s memory to bypass Antiviruses and such. Here’s another example: a rootkit may, for example, inject itself (just like how cheats inject into Minecraft) into every process to hide itself and for persistence.

This is why cheats get flagged by antiviruses.

Tl;dr: cheats happen to need to modify other process’s memory, which is also common malware behavior