What exactly is punkbuster? How does it works? and why it isnt always "turned on" instead of giving the client an option to turn it on or off? Thanks in advance.

Punkbuster is an "anti-cheating" system for many commercial games.

It checks to see if your client is significantly out of sync with the way the server is configured (for example, wider FOV, screwed up video driver, bizarre cvars, compromised files in the game directory).

You can read more about it here. Some people don't like it, and it's always better to give the server operators an option to not require it should it end up being defective or deprecated 10-20 years down the line.

The ultimate goal of PB is more to make cheating as difficult as possible instead of impossible, I guess you could say.

Does locking your front door when you go out guarantee that no one will ever steal from you?

Punkbuster is an anti-cheating software that not only checks to make sure that the client is within a tolerable limit of the servers state, but it also checks for various common hack processes, such as hooking the video driver to get away with seeing through walls, or more common aimbots, its not foolproof, and sometimes I think the sporadic lag spikes are a nuisance, but it does seem to decrease the amount of cheaters.

oh and you do have the option to enable/disable PB, well depending on the game your playing, quake3, and most games based on that engine have to options, /pb_sv_enable 0|1 and /pb_cl_enable 0|1 first is for the PB server, and second is for the PB client.