How exactly do injection/reflection bots prevent detection? Can jagex ask your client to send a list of all your loaded classes and they determine which ones aren't part of their client? Obviously the existence of runelite/osbuddy causes problems for it, but it seems simple enough to do a check to see if anyone has changed a field's visibility and flag them.