You're also fundamentally misunderstanding the design.
> 1. Client input is either dropped or the input is applied but in an unexpected position (because when the user input occurred the client visible state was wrong)
The system is built around rewarding the player for making good inputs and tracking the state in which they made those inputs. It's not as far as "all perspectives are valid" but it's close.
- Player A moves in to make a hit. The character starts the hit react.
- <lag>
- Player B see's the telegraph and makes a valid block.
- <lag>
- Player A receives the rollback and the character moves into the block animation instead of the hit react. Ideally this is unnoticeable.
Cheating is handled by console DRM and root kits. Similar for Overwatch, similar for Valorant. Such is the state of the art.