since the server validates everything anyway
Oh you sweet summer child.
The server doesn’t validate shit, because that takes up CPU cycles on THEIR hardware, which costs them money. A huge part of kernel level anticheat is forcing YOU to pay the cost for anticheat, so they can squeeze a few more pennies out of it. And if your computer gets owned because they installed insecure, buggy malware on your system…? Well, they’ll just deny. After all, it’s kernel-level, how are YOU going to prove anything?
Apparently some corporate dick sucker scrapes the public feeds for the bikes and volunteered the information for the likely bike pretty much immediately.