No one really knows what data Jagex really collects which are "bannable" though.
I've always thought of their system as having different levels. Say they collect 16 different kinds of data, stuff like play time, mouse movements, camera movements, gold earned, clicks per minute, time spent with the mouse out of the game, etc etc etc etc.
Then it would get flagged when it breaks a "norm" that they've set up, and the more breaks, the more flags. So if you play 12 hours a day, you break the average, so you get a flag there. You click 60 times a minute on average, flag. You got player reports? flag. And at a certain amount of flags a mod will check the account. But then again it's just speculation. But if this were the case it would just require to go through every single action, and make it biometric somehow. So you'd never get flagged. Sure you could get reported, but that's inevitable.
Yes, their detection software may be just as limited as bots are, but other players and especially jmods viewing your account data can recognize bot-like behavior much more effectively.
How so? Take a look at my ramble above, I know it probably makes no fucking sense, but since Runemate has biometric mouse movements, those wouldn't raise a flag for a jmod, would it? So if you could do that, for every aspect of the game, they wouldn't be able to differentiate between players and bots, right?