If I remember right, VAC doesn't necessarily immediately ban a cheater. It might instead put them on a list. After the hack's popularity increases, there is a mass ban of everyone detected using the hack at a later date.