In short: Ultima Online is old and Broadsword doesn't want to upset its playerbase.
Cheating was not considered (much) when the game was originally made and there have been no serious attempts to curb cheating since. The client is literally wide open to probing and manipulation.
It's so easy, I did it myself. With minimal programming experience. I didn't make cheats though
I made some tools to use with the EM Program.
It would require a new client. Which they tried, a few times even. But the playerbase rejected those new clients. Now there's no money for a new client and they've had to give up.
As a result, I was not allowed to action scripters.
I was perfectly equipped to recognise scripters. As I've written a fair few myself in my playing-days. Complex scripts too like complete a BOD filling bot and an in-game lottery.
We never actioned automated play, only unattended play.
Whenever a player was reported for scripting or even multiboxing: I would visit and try to speak with them. Protocol was to give the player ample time to respond. Then I'd move them to jail and try speak with them again. On the whole a player was given several minutes to respond. If they did, they were off the hook.
When I concluded a player was unattended; I would action their account. First offence was a warning, then a 24h suspension, then 48h, 72h and finally termination. Violations expire after 1 year. I don't recall ever requesting a termination.
These policies were without a doubt the biggest thorn in my eye. Total Weak-Sause! But what can you do? Economics win.