They'll get away with it until they suddenly don't. There have been a multitude of server-to-client and client-to-server RCEs in Source, in the worst case scena

They'll get away with it until they suddenly don't. There have been a multitude of server-to-client and client-to-server RCEs in Source, in the worst case scenario someone could have deployed a worm which infected servers which infected their clients which infected more servers and compromised practically the entire active playerbase. They're just lucky it hasn't happened yet. What it would actually mean for Valve if they allowed that to happen is hard to say, since they're in such a firmly entrenched position with a near-monopoly on PC game distribution, but every CS:GO player getting cryptolocker'd wouldn't be good for their brand to say the least.