Can hackers control RemoteEvents that only goes from server to client?

You can make sanity checks and maybe caches too, to prevent them from spamming the remote.
Source 1

Source 2

Maybe these 2 could help you