It could also be that he had cheat engine installed on his system, according to some people VAC automatically triggers when this software is installed.
also google gave me the following information:
I know VAC bans are delayed, with a detection putting an invisible flag on your account to be banned during the next mass ban.
So It’s probably not from ToS?