You have to do it on the server. And it's a pain to implement correctly, full of cryptic error codes. I imagine many developers skip it since it's not required by Apple.
It's a tradeoff, really, that most IAP implementors consider:
Cost of support and loss of goodwill when legitimate customers run into issues vs. loss of revenue from pirates (heretofore only jailbroken phone users) who likely wouldn't have purchased anyway.
It makes fiscal sense for big players with big IAP scale like Zynga to strictly validate. Little players may find it is less critical to the bottom line to be strict about it.
If the value of the status key is 0, this is a valid receipt. If the value is anything other than 0, this receipt is invalid.
http://developer.apple.com/library/ios/#documentation/Networ...