Yes, for an FPS I don't really see a practical way around having the server do some rendering work, in order to detect occlusion and stop sending visual updates

Yes, for an FPS I don't really see a practical way around having the server do some rendering work, in order to detect occlusion and stop sending visual updates when it's pretty sure the client isn't able to see that object. There's a balance to be struck. Other techniques include simple statistical analysis: it's usually pretty damn obvious when a player is making inputs that shouldn't be humanly possible consistently, or reacting to information they shouldn't be able to see. That doesn't have to be done in realtime, it can be stored and reviewed later. (That might even be a feature on its own: delayed bans make it harder for cheaters to know if their techniques were detectable.)