Some genres of games (like RTS) typically do send inputs instead of state. Cheating is indeed possible.

Cheating in the sense of breaking fog of war, because the client has to actually have the whole game state in memory due to deterministic synchronization. Yes.