Why can't the anti-cheat detect every hacker, and ban immediately?
Most cheats(Hacks) are being updated very regularly..(Huzini,Wolfram,Liquidbounce,Pandora etc..)In order to compete with it the system has to ban more hackers and get used to the data and if there's a similarity the system could become more confident in detecting cheats.
More better cheaters use ALTs (Alternatives) for their Minecraft Cheating. They play on half-access accounts which are cracked(Passwords are phished, or hacked into) and cheat on that. The owners of the ALTs get banned, and the original cheater, who didn't cheat on his MAIN account doesn't get banned. This is how most cheaters play on Minecraft servers.
Minecraft has been sold over 26million times (More than the population of North Korea :P) and atleast 30,000 accounts are used as ALTs. Only 1/3-1/4 of these ALTs are inactive users, or have sold their account.