While developing an anticheat, I discovered that exploiters can destroy any individual object in their characters, including non-physical items like decals, joints, and scripts, and that destruction replicates to the server. This behavior is also not documented where it should be.
This can happen pretty much everywhere that uses the default characters familiar to Roblox players, and is not limited to Roblox Studio.
For example, if I run this script on my client, my limbs and t-shirt disappear on both client and server.
local character = game.Players.LocalPlayer.Character character.LeftUpperArm:Destroy() character.RightUpperArm:Destroy() character.LeftUpperLeg:Destroy() character.RightUpperLeg:Destroy() character["Shirt Graphic"]:Destroy()
I did some more searching, and it turns out this is an old issue.