Lower damage. Something like 100 base damage full charge (meaning 200 damage headshots, 100 damage everywhere else). That takes care of the Zenyatta problem, makes it so that she can still instakill all the low health heroes if she lands her headshots, and reduces the reward for playing her poorly (i.e. spamming shots and bodyshots). That leaves the skill ceiling and its reward high, but reduces the effect of having even a mediocre Widowmaker in certain contexts.
Because seriously, fuck Widowmaker. I like the character concept, I like the kit, but it's the same shitty overpowered twitchy sniper rifle that's ruined matches in every multiplayer FPS since the Railgun in Quake.
I'm okay with Hanzo having better damage because Hanzo players actually have to have a modicum of skill beyond twitch reactions and he doesn't have the wallhacks ult.
--
EnigmaticHat, you pretty much just agreed with what I said. A McCree who isn't in your face can be killed by anything with good ranged DPS and/or a way to negate his shots. If he runs at you, you kill him. He's only dangerous when he gets the drop on you--which, admittedly, can happen a hell of a lot if it's a good player who positions well. That's why you react to the presence of a good McCree by not putting yourself into situations where he can ambush you, just like you don't walk out into the open if there's a good Widowmaker around, or play games at range with a Mei who can shoot accurately with the M2 icicle.
Yeah, if he flashbangs you you're dead. If you turn a corner and he fans with proper recoil control, you're dead. That's why he needs to be nerfed again, the lack of counterplay at close range. But he can't fire fast enough or do enough damage at range to stop a Hanzo/Widowmaker/Pharah/Mei from killing him. He can't flashbang and fan a Junkrat spamming grenades through every potential ambush spot from a dozen meters away.
Besides, basing your argument on the best McCree players working in premade teams isn't really a realistic representation of the McCrees most players will encounter. It's like pretending that every decent Genji out there is as good as Seagull. And, fittingly enough, at lower skill levels Genji does effectively counter McCree, since most aa players of the latter don't have the knowledge or reaction times to alter their throw to avoid the reflect. You see Zarya and Mei ults get deflected, and you think that most McCrees are going to do better with the ability they're habituated to spamming at peoples' faces?
Not to mention how the low update rate can affect things--I've had plenty of times playing Junkrat where I flung my concussion bomb at the floor in front of me to blow a Genji away and promptly died, then saw a kill-cam shot of it flying right at Genji's waist or legs and getting deflected back. Shit like that happens way too often, and I've seen it a time or two with just about every ability that can be screwed up by the client and server not being closely synced.
He certainly needs a nerf, though, since he's nearly as oppressive as Widowmaker if anyone remotely competent uses him. Even if those are pretty rare compared to the people who think that they're competent with him.