I think I understand what you mean, but I’m afraid that detecting when any instance is added in memory wouldn’t and/or won’t perform well, since game objects with nil as a parent are located in memory, along with all other objects, variables, game instances and more. With events such as ChildAdded and DescendantAdded we can detect added instances inside game environment. You can listen for changes, although stay aware that most client changes don’t replicate across client-server boundary (animations, sounds, click detectors, client simulated physics etc.).
You can surely listen to game changes, but don’t overdo it, both client- and server-side, but don’t overdo it, since that will lead to high resource consumption.
EDIT
@Thigbr yes, that is correct. Unless using yet undiscovered bugs, one cannot access CoreGuis. Consequently, we can’t listen for changes either. Detecting unwanted game objects is not practical. We can either listen for changes on specific areas, or scan the whole game data model like you proposed, which is a good idea! However, games can be pretty large and contain numerous parts and other instanced, making such approach slower, thus not to be used constantly.
More about CoreGui here:
EDIT (2) @RageOfficial_Support
There are a lot of topics on Dev Forum discussing this same exploit prevention possibility, and pretty much all consider focusing on other exploiting aspects as a conclusion and best practice.