Client-side anti-cheat is a band-aid that will always punish legit players and merely hinder cheaters.

'The client cannot be trusted' applies to simple HTTP exchanges as well as to game state.

Of course, if the server has to track and validate everything, it would cost more to operate game servers....

This is a solved problem with dedicated servers and a proper community. They're just trying to sell you One Faceless Corp Server because it makes them more money, even though it is less efficient because of scaling problems and also you have less control.

This is "It works better in the app" applied to gaming services.