I’m aware that the animators need to be created on the server for animations played client side to work, but what stops a player from simply grabbing a random animation and loading it on the pre-created animator? The documentation doesn’t really clarify this. Do animators already come with pre-approved animations that can be played on them?
Nothing stops them from doing that.
You should have internal checks on server what animation client is loading and punish them if they use not allowed animations (def exploiter).
All animations loaded by client to animator do replicate.
what stops a player from simply grabbing a random animation and loading it on the pre-created animator?
Nothing, the Animation instance won’t be replicated, but the character’s movement (caused by the animation) will be since the client has network ownership over their own character.
Do animators already come with pre-approved animations that can be played on them?
No, but you can use the Animator.AnimationPlayed event which is fired whenever an AnimationTrack instance loaded from the Animator is played, you can then determine whether or not this AnimationTrack instance is expected.