Surely, if the system is server side, then it's not in the hands of the attacker? For webapps, etc. it's not the client side code that's protected, but the serv

Surely, if the system is server side, then it's not in the hands of the attacker? For webapps, etc. it's not the client side code that's protected, but the server code and data.