Yes absolutely. Programmers/devs often get way too wrapped in doing everything _right_. But doing it right takes time and money. Commercially it makes sense to get away with the bare minimum. The holes will only be an issue if the product actually takes off.
But think about it for a moment. Assuming the ideal product would have both client + server verification, it's clearly less work to only do client-side verification. The product can be released quicker.
Maybe they intentionally forgo the server-side verification code until they actually get cheaters. Then they implement it before it begins to hurt their bottom line.
Because what if the game was an utter failure, and never got any users? How glad would you be that you spent all that time writing the server checks for every game action?