They instantly detect it but they don't ban it instantly. The collected data is reviewed by a human and is sent to machine learning engine(I don't know if they use this engine). Human review is required to eliminate any false positives. If multiple signatures are found to be different then it means app has been tampered with. That's why they ban in waves.
People misunderstand it. They think ban waves are used to conceal the working of anti-tampering technology.




