1) When DMA is fully blocked, Aimbot resorts to being a pixel bot.
2) Once you're relying on a pixel bot, all the anti-cheat has to do is "bait" the bot. After you click the bait a few times, you're banned. (:
RuneScape is actually the pioneer of this technique.
The most helpful approach in my view is to make fresh accounts expensive for cheaters so they can't iterate easily; if the game developer can extract profit from such ban circumvention attempts then all the better.
If you are successfully baited and detected, you also get HWID banned, so it only takes once. This makes cheating via pixel bot unviable.
On the contrary, DMA is so desired because it eliminates this risk.