> Auto-fire is trivial to detect
Tell me you've never worked on an anti-cheat without saying you've never worked on an anti-cheat.....
Why do you even say this if you really don't know it?
In short - you don't want false positives with anti-cheat, you can tolerate some false negatives. Input timings and sequences are impossible to use for this, as button mashers (it's a pseudo-sport) can press buttons at up to 20 times a second - far faster than auto-fire would. Regularity of presses just takes care of the most obvious auto-fire, but once again - there isn't a clear human-robot threshold. And most auto-fire will be far on the human side.
So you normally use a composite or layered approach. If there are enough signals of cheating on layer 1, you do more thorough checks on layer 2, 3, etc. The higher layers can be other players watching replays, ML, behavior-matching, and so on. Layer 1 can be "too lucky" checks, speed checks, ESP (extra-sensory perception/clairvoyance), altered memory, data packet manipulation, suspicious IPs, honey trap code paths/memory locations/impossible game states, skill inconsistencies, stupid values written into obfuscated memory, etc. All of those, by the way, have significant false positives on a large scale. But higher layers are almost always heuristics-based (human or machine), and with high false positives. So all together - not good, not easy.
KM setup is easier to detect as there are certain expectations such a set-up must meet for the user, which are a different set of expectations from a controller. But it's still harder than one might think. Analog triggers can be simulated, noise can be introduced in smooth mouse movement, button presses that aren't feasible on a controller can be disabled on the keyboard, etc. Once again - the issue is with false positives. You don't want to ban a person because they play the game more "cheatey" naturally than the hardware that fakes it.
Tamper-proof hardware with an auth mechanism is a really elegant solution for near 0% false positives. You can't mod a controller if you can't open it.
And I suspect that players wouldn't mind buying such hardware if it put them in authenticated/cheat-free lobbies.
What Microsoft might doing here is a slightly different topic. All I am saying is that anti-cheat is really not what you're saying it is.