You can always leave some crucial part or procedural generation on server-side too and impose some limits on how client can use API to it. E.g client might do a

You can always leave some crucial part or procedural generation on server-side too and impose some limits on how client can use API to it. E.g client might do any kind of heavy lifting (generation of terrain, etc), but code that handle important stuff (e.g PvE enemies, rewards) could be stay on server-side.