I had a software security class that was taught in effectively the same way. The professor knew they had to give grades so they just set it up such that the midterm and final accounted for the bulk of the grade and made them really easy. This ensured that almost all students would get at least a B using conventional brute Force studying methods. This removed all of the traditional grade optimizing pressures. He then made the homeworks and labs quite difficult and made them require a lot of independent research so that you could be free to try hard and potentially fall short without fear of getting owned. You would basically get out of the class what you put in. It has so far been my favorite class in my program, the one I learned the most from, and one of the most empowering classes I've taken.

Sounds good, but I could easily see this backfire with students that have been taught to hack the system: "Great, we're getting an easy pass here, let's spend zero time on it and focus on those other subjects that require rote memorising"

Right, but that same thing would happen with more intensive testing anyways. You can lead a horse to water but not make him drink and all that.