You need something more sophisticated, otherwise it's easy to confuse high skill and/or well memorised lines with cheating. And a good cheater will be smart enough to either use engine assistance only in difficult spots and/or frequently pick the second/third best moves from the engine.
Correct. My idea is actually that with some grace number of moves that players can play by the book (i.e. openings). After that, run the analysis I mentioned. I agree that playing OTB is more stressful and that is difficult to model in such an approach. I was hoping to at least get some signal to filter out the mostly obvious cheaters and so focus on the remainder that should be less obvious.