It's just capturing inputs and replaying them.

That's not true though, is what they're saying. Quake demo files are server-to-client packets, results of the simulation, not client-to-server packets, the inputs.

If you wanted to add random critical hits and random bullet spread based on the pixels in a live feed of a lava lamp cam, clients could still record .dem files and they would still work.