So this should no longer be possible with latest versions of Clients due to this change.
EDIT: I may be wrong about the above, since bad actors can still modify flags in memory, but not through local file editing.
Separately, because of Roblox’s Client-side nature of character physics players manipulating their outgoing packets can recreate the effect even without access to flags.
My understanding is that most shooters on Roblox do a “loose hit verification” that at least checks whether the character could have possibly have made the shot on the server at all (IE: Are they even in range of the enemy?) Does this game not use a similar pattern?
Long term, this is one of the things that Server Authoritative tech will help address more wholistically.