As a relative novice when it comes to multiplayer game programming, your comments have been enlightening to me.

I’ve grown my experience over the years in other fields to a point where “don’t trust the client” is nearly second nature to me. So whenever I’d dip my toes into programming a game, and look at multiplayer server side stuff with puzzlement, trying in vain to work our where or how I’m supposed to be validating the legitimacy of the clients incoming game events. It never before occurred to me that doing this kind of server side validation might be too burdensome. The notion that the backend code I was trying to understand had been written with minimising cost per player hour as a positive metric is now so face-palmingly obvious that I am still stunned at how I never realised and literally having a string of “oh and that’s why that bit there..,” as I write this.

So thank you very much for your comments.