Well, PunkBuster is piece of crap that doesn't work. It can detect only few cheats. At least it's still somewhat better than similar craps used today (for example, BattlEye used by PUBG and other games). These modern alternatives are fully featured backdoors to your system, so it's basically an official virus. If you see any game using things like PunkBuster to prevent players from cheating, you can be sure that network part of the game is so badly designed, and its developers just grabbed the easiest and fastest way to fix the problem. Sadly, Crysis also belongs to this group. The only true way to prevent cheating in multiplayer games is to use server-authoritative model as much as possible. In short it means that all important things must be handled on server to prevent clients from messing with them. Any other way just doesn't work.
So, most players don't have PunkBuster installed and they shouldn't install it. Cheating in Crysis is problem and there's no 100% protection yet. Some cheats can be detected on server-side by server mod (SSM). Also, Crysis contains integrated file check that can be activated or deactivated via sv_cheatProtection cvar. Right now, there's no server with file check enabled, because it brings more problems than it actually solves. A lot of players have somewhat corrupted files, so they can't play on servers with file check enabled unless the server doesn't check certain files. Really big thanks to our weird friends from GerCry, because it seems this problem is mainly their fault. Their multiplayer "client" even includes real cheat called "lawmod" (aimbot for rocket launcher).
As you can see, the situation is far from perfect, but Crysis is not a competitive game (and it will never be probably), so playing it just for fun is the main thing here. :)