Any kind of cheat that loads lua into the real client state will be detectable by some means. All of the bigger cheats load in their hack into an emulated client state basically which you cannot touch through lua, even though it is all lua.
Can’t do much about that unless you’re writing your own binary module which you would have to get players to install. It’s really not worth it too. Focus on making you server secure instead of protecting it from people with ESP.
If you fix holes in your server like exploitable net messages then the WORST thing cheaters can do is aimbot and use ESP. It’s not like there are hacks out there that give people full access to your server (unless you have unsecured stuff).
If you’re really on the edge about external cheats, think of a really crazy way to screen grab without making the cheat recognize it as a screengrab so you can check whats on their screen. That requires a lot of work and manual banning though.