You can’t make your name something different. Exploits usually operate on clientside (unless you’ve been backdoored). This means that if the exploiter changed his name on his side, it won’t replicate to the server. Other players will just see his regular name.
Yes, an exploiter can change their name client side. Anything on the client can be changed, no matter if it is restricted in studio.
There was an exploit that allowed for users to change their name and it replicated however that has been patched.