I'm not convinced of this, and the general trend of every online game that cares about cheating since at least QuakeWorld (1996) is moving in the direction of not trusting the client for important things.
> Keeping everything and all variables on the server is impossible
True, but you can get quite far by only giving the client the information they're supposed to have. Wallhacks were originally possible in Quake because pre-QW, the client received the position of every player on the map.
The strongest way to prevent wallhacks is to only tell the client about other players they should be able to see. The id and valve engines do this, for the most part. Again, quakeworld in 1996 severely curtailed wallhacking by only showing the users players that were visible, or "almost visible", i.e. near corners.
Your example of infinite health packs is something that could be trivially tracked on the server side and is, even for games as big as WoW. WoW tracks the current inventory of every single player in game. You can tell because sometimes when there are server glitches, you're unable to pick up loot from dead monsters.