It only requires the client have a list of currently legal moves, not the complete ruleset. Though I generally agree with you, it's convenient and not at all an

It only requires the client have a list of currently legal moves, not the complete ruleset. Though I generally agree with you, it's convenient and not at all an antipattern to have some of the rules logic in the client - for example, you might have no other reason to generate an exhaustive list of legal moves server side.