Having your server verify every action is the only way to prevent hackers from simply sending a packet that says "I got a headshot on that guy". Instead the server replays through all their actions. You never say you got a headshot, you just say when you clicked and the server figures out if you hit.
And because like you mention, clients only receive gameplay data and not the fully rendered screen, this allows clients to do things like interpolate the (delayed) server data with their own realtime input elements. Otherwise every single action you take would be delayed by whatever your latency is, and every other player's actions would be delayed by a similar amount. Instead, it appears seamless until your latency gets so bad that you just begin teleporting between positions because the server can't track you well enough (often called multiplayer rubber-banding).
Instead (well designed) game servers run their own authoritative version of the game world and track each player's latency, and use that to replay the previous few ticks of the game when an input comes in from any player. So if you have a 100ms ping, and press "W" to walk forward, when the server receives your forward input it treats it as if you have been moving for 100ms already.
Basically, saying every player shares the world model is incorrect unless you can set them all to the same latency.
https://developer.valvesoftware.com/wiki/Lag_compensation
https://developer.valvesoftware.com/wiki/Latency_Compensatin...
Edit: additional source, these gafferongames articles are a bit old (2004) but still extremely relevant.
https://gafferongames.com/post/networked_physics_2004/
https://gafferongames.com/post/what_every_programmer_needs_t...
Complex physics with high object counts can be difficult because synchronizing a lot of state is bandwidth intensive. Most games with lots of moving objects (RTS for example) use deterministic lockstep so only inputs need to be transferred, even if there is an authoritative server.
Exactly, companies like "Artificial Software" (artificialaiming.net) have been selling aimbots for FPS for a decade or longer. I was curious back in 2009 and purchased access for a game in the Battlefield franchise.
It allowed me to have colored rectangles around all other players, my own team being green and the opposing team being red. You could see this rectangle through walls which would let you rack up kills and avoid getting ambushed. You could also auto-aim and tell it if you wanted the head or the torso, you could headshot people that were so far away you could not see a single pixel of their body. It also allowed you to start using your knife rapidly if an enemy got within a certain proximity of you.
It would even allow you to spawn in on enemy team memebers instead of your own team on maps that allowed you to spawn on team members AND it would change your name on non-hardcore servers to appear to appear as an ally to the enemy so you could spawn on one and casually follow them around, them thinking you were on their team, and just knife or headshot them when you wanted or follow them to a group of them and det pack/grenade/spray and pray and kill a bunch of them.
A quick look at their site and they still have many bots that still allow many of these features (and others like radar hacks, no recoil, no bullet spread etc) for various titles because all of this is still on the client side.
Matching output seen on the screen has existed for decades under the umbrella of macros. I remember writing my own for an MMO around 2005 using AutoIt; it was significantly easier than any client modification.
Of course I'm just theorising - it could be an idea that no-one's implemented yet.
Unless you are Tarn Adams
P.S.: Don't take this statement the wrong way, I love small indie devs and donated for Dwarf Fortress.