This isn't "expert" level knowledge. This is a basic principle of any client / server system. In fact, including default client side protections would not have

This isn't "expert" level knowledge. This is a basic principle of any client / server system. In fact, including default client side protections would not have fixed this issue (since this issue involved bypassing client side protection.)