you could look at what these specific scripts are doing and try and detect their outputs e.g,
for a flying exploit find the velocity it carries the player at look for that in players characters
you could look for irregular spikes in player stats/invetory (keeping regard to the fact they could be buying a gamepass etc) like if its physically impossible to get more than 1000 coins at any given time without gamepasses check for that every now and again
and as stated above secure events can do this by verifying events you could make a hashing function in a module script of the top of my head and then make changes to it once in a while this alone would completely stop your average joe in his tracks i believe
I believe you don’t have to worry about the loadstring code, roblox studio automatically turns off the loadstring feature on server script service unless you turned it on
you should also add sanity checks to your remote events to secure them
an example of a sanity check:
client fires a remote to buy a item and it costs 500, the server verifies it by checking the amount of money the client has and the price of the item
Exploits are remote-executed local scripts, they have access to the loadstring global regardless of whether or not scripts within the ServerScriptService container do.