As a relative novice when it comes to multiplayer game programming, your comments have been enlightening to me.
I’ve grown my experience over the years in other fields to a point where “don’t trust the client” is nearly second nature to me. So whenever I’d dip my toes into programming a game, and look at multiplayer server side stuff with puzzlement, trying in vain to work our where or how I’m supposed to be validating the legitimacy of the clients incoming game events. It never before occurred to me that doing this kind of server side validation might be too burdensome. The notion that the backend code I was trying to understand had been written with minimising cost per player hour as a positive metric is now so face-palmingly obvious that I am still stunned at how I never realised and literally having a string of “oh and that’s why that bit there..,” as I write this.
So thank you very much for your comments.
I'm getting very tired, and irritated so my responses are coming off as unreasonable now, so with a final hopeful breath let me say the following: I hear what you're saying.
Truly I understand that you think that it's super easy and we have so much money that it should be solved.
We don't have the money you think we do, we run on very thin margins, in both time and resources.
Others have mentioned that we should shift the burden of running servers to users, but that has many tradeoffs and doesn't work for many games- especially not on consoles. Especially not in the sheer numbers of users we have.
The issue is also understanding what 'security sensitive parts' are, because what is that? Everything is sensitive, movement, bullets, health, what you see, what you hear, what you can interact with, what loot you picked up, what gun you have equipped and how fast it's equipped, how fast you reload, how many bullets are in the clip.
If you were to stall a client so that the server verified you could do those things then your game is running 1 frame every 20 seconds. That's even if you had infinite performance on the server to make those calculations for the 24 players that can see each other.
It's a hard problem, one I genuinely invite you to solve for yourself, maybe the answer is to make much simpler games like CS:GO or Minecraft.
Or maybe the answer is simple and everyone I work with, both in my office and in the industry of AAA gaming, is malignantly incompetent like the commenters here keep suggesting.
[0] https://www.youtube.com/watch?v=r6Ex29gzqgc