If I change, let’s say, the walk speed property of humanoid in my character on the client, other players in the game will be able to see the change, they will be able to see me walking faster, but the actual walk speed property value of my humanoid object on the server will still remain at 16. Basically, every humanoid change made on myself on the client will get replicated on the server (so other people will be able to see the changes) but the actual value will remain the same on the server.
This would help make better anti-exploits because currently, when an exploiter changes their speed locally, other players are able to see them going faster, but the actual server can’t see that because the actual value on the server hasn’t changed and still remains at 16, even though the player moves a lot faster. And this would only be identified by a client side anti-exploit script, which is super unreliable.
Expected behavior
Either the actual humanoid property values should get replicated too or it must be made so humanoid property changes can’t be done from the client.
Client side changes are not updated to the server. What you are seeing is the client side change to walk speed allowing the player to move faster, the player position is then updated on the server and replicated to the other clients. This is as expected in normal roblox, client physics is trusted, but data is not updated back to the server.
Edit: The logic to this is the client cannot be trusted, so you absolutely cannot allow it to arbitrarily change data on the server. You can send requests to the server via events, which you then need to sanity check on the server. It is pointless trying to make something readonly on the client, because there is no way to enforce it, you do not truly control the client.
Physics is done on the client to avoid having to deal with the complexity of lag / stutter. This creates a significant security vulnerability which currently can only be mitigated with coding to validate on the server. There is a switch to an authorative server model in beta at the moment, I would expect this to release early next year. This will resolve many of these issues.