If I make a part on the server and create a .Touched event on the server too, A client can move that part on their side to trigger the touched event? And to achieve this the part must be anchored? what if the part is unanchored will it still happen?
And to fix the above problem, to apply validation (do you have an example? because if I generate a .Touched fireball on the server, the validation that comes in mind is detecting if the fireball is actually close to the user)
Lastly, what does SetNetworkOwner do for this, does it patch any exploit or?
if the part is not anchored i believe the same happens? im not entirely sure you can test it out to see if setting network owner to another player and see if others can use that part to trigger anything.
For something like a fireball; you can check if at the hit registered time based on their logged last position and hit position if a hit was possible based on the projectiles velocity; remember to always include a leniency so as to not cause false positives when creating antihacks/antiexploits.
SetNetworkOwner basically means u hand over the physics of a part to a owner i.e they can do anything to manipulate its cframe, position, orientation, etc… this does not patch any exploitation but rather setting it to anything except the server invites exploitation; The reason you would set the networkowner to anything but the server is for smooth physics replication for clients for example your character model in game is owned by your client had it been on the server it would have been a very laggy experience for you.