It's not easy to prevent cheating, especially in open world games. There's a pretty good high level read on this here - https://www.pcgamer.com/why-is-it-so-hard-to-stop-cheating-i...

In essence you pretty much have to delegate some of the computation of game physics etc to the client - doing everything on the server isn't going to scale. But the moment you delegate that to the client you open the door for cheating.

The current best practice in preventing cheating seems to be "referee" code that performs checks that what a player is doing is actually "sane" within the rules of the game. But in the end it's an arms race between cheats and anti-cheats, which means game companies are always going to be playing catch up.