Client-side anti-cheat is a band-aid that will always punish legit players and merely hinder cheaters.

'The client cannot be trusted' applies to simple HTTP exchanges as well as to game state.

Of course, if the server has to track and validate everything, it would cost more to operate game servers....