If it is suppose to help against cheating, why is it not already enabled by default?

Because it literally stops you form running the game in widescreen for example as it only punishes legit players just like all forms of DRM including modern anti-cheat and is completely ineffective against what it's meant for.

Isn't VAC a good thing?

VAC is a rare exception that isn't actually annoying, but sadly the norm is most of them are, be that 20 years ago or today, only difference is in old games such as this you had the choice to play on servers that use it or not unlike today where broken anti-cheat is forced on you to even play the campaign then proceeds to falsely ban you.
Also probably there's no one miserable enough they'd decide to cheat on this game in current year anyways so it's much better to keep Punkbuster off for compatibility reasons on the official servers. There are community run servers you can play on instead if you still wanna use it, the choice is yours as it should be.

PunkBuster as an anti-cheat doesn't work any more on ET, that's why it has been removed from the Steam version and can't be enabled. It's still used on 2 ETPro servers (Hirntot and HBC) because our custom ban system depends on it, but as an AC it isn't used.
It's not true that it doesn't allow you to play on fullscreen. And you'd be surprised, there are still cheaters, but we successfully keep them away with our custom ban system.
Here's a guide how to play on ETPro with PB still:
https://steamcommunity.com/sharedfiles/filedetails/?id=2801141726

It's been removed because of rights: the Steam release had to be recompiled, and so without that proprietary software
PB doesn't stop much anymore anyway
Just go with ET: Legacy

Punkbuster is incredibly old!

Because it literally stops you form running the game in widescreen for example as it only punishes legit players just like all forms of DRM including modern anti-cheat and is completely ineffective against what it's meant for.
Never had issues with PB as you claim.