does VAC work anymore?

Lua scripts just don't get you banned. There was a DLL floating around that got a large number of accounts banned but in the case of Lua, it would be too hard to enforce. I mean, lua_openscript_cl is specifically designed to run a lua script client side, and the command is there regardless of if you are in a multiplayer game or single player game. Even then, there are hacks out now that completely bypass the likes of setting sv_cheats and running your own script. They just inject the thing in single player and off they go!

VAC has been removed for a number of years but there is a pretty basic Anti-Cheat that was implemented that caught the DLL I was talking about earlier. I wouldn't worry so much about GAC though, I would be worried about CAC given that is a lot more responsive if you don't have your stuff injected.