Problem with purely server is if I tag a player, my client will say I tagged them, but the server will say I didn’t. While yes, that can prevent exploits doing it on the server, the amount of backlash I’d face for players saying they hit someone and that person not doing would be greater. I know games like Arsenal use client side hit detection.
The idea tho, is while yes, an exploiter could say theyve tagged all these players, the server still does checks to make sure they fired a bullet, that bullet is near the players position, etc. to make sure its valid.
Killing a player on the client is purely visual. So exploiter can do it all they want, the server at the end of the day is what confirms and kills the player