To answer your question - Yes, the client can read data from Workspace,
TL;DR - Read this: Client-Server Runtime | Documentation - Roblox Creator Hub
If you have Accurate Play Solo enabled in Studio - then press Play Solo and look at the Explorer window, you’ll be able to see everything that the Client can see.
This is because APS mimicks a live client and server.
The thing is, the client can absolutely read and manipulate any object it can see, including the Workspace.
However, such changes do get shown to the Server.
In order for changes to be seen on the server, it must go through a Remote Event/Function.
You’ll probably know the following information, but just in case, here’s a quick summary of clients/servers.
The Client
The client is basically the machine you use to play Roblox. Whether it is a Desktop, Tablet or Phone.
Animations, GUIs, user input, the player’s character, camera, graphics rendering, sound and local scripts all run on the Client.
Anything that the user can see on their device is present and changeable by the client.
The Server
Think of the server like a middle-man - its used to securely connect and communicate information between all clients.
It holds data about the game world, and handles communication with services outside of the game, such as datastores, http requests, loading assets etc. It also runs server-side scripts.
Communicating with the server
Filtering Enabled fixed a huge security risk that had persisted in Roblox for many years - that of the Client being able to manipulate things on the Server and other Clients.
Roblox has set up the servers to let basic communications through, such as where a part is positioned in the world, or where a player is moving to, when it dies or respawns, etc.
However, now because of Filtering Enabled, the client can only talk to the server through Remote Events and Remote Functions.
One way of understanding what RemoteEvents / Functions do, is to imagine two people who speak different languages, who are trying to talk to each other - they need a medium - such as Google Translate.
The same idea exists when the client and server needs to talk to each other. Remotes are used to communicate between the server and client.