"players cannot hurt players",

this Rule doesnt work
Tried on default settings

hi, default settings most definitely do work

so either another plugin is allowing the damage or you are not using default settings

server.pve convar should not be set true either