Never trusting the client just means the server must assume any messages from the client may have been manipulated or fabricated. A message like "the cursor is

Never trusting the client just means the server must assume any messages from the client may have been manipulated or fabricated. A message like "the cursor is over this guy's head" would be an egregious mistake in the protocol because the client can easily lie about that. Lag compensation is more subtle because it's the timing between messages that may be manipulated, only for a small fraction of a second, and the client will have some uncertainty about the server's actual lag estimate. But it could be abused, for example, to trick the server into applying a "player shoots" command 50 ms earlier than it otherwise would.