3. write your codebase in a way which is suspicious of client data and gives the server much more control (easier said than done however)

That's just server-side anti-cheat, which I've already addressed.

Cheating isn't always about manipulating game state, especially in FPSes. There, it's more about manipulating input, ie, auto-aim cheats.