It’s good you are thinking about exploits but there is nothing exploiters can do here. The server will just send the client what the NPC is saying, and the clients possible responses, and when the client responds with either option one, two, or three, just run the appropriate action or next dialogue.
I don’t understand the concern. Clients will always be able to access their owns scripts and you are always required to interact with the client when scripting. So, as long as you check the information they send back when running important functions, all will be fine.