Some things are legitimately much easier to restrict client side e.g. for FPS: you can send other-user data all (or much) of the time and not have to worry about if they're looking in that direction, or if there's line-of-sight through the hole they just shot in a wall. That kind of thing takes a lot of server-side compute, and unless it's perfect it's still a competitive advantage.
But when it's not competitive? And they're basically just blocking abusive clients? Heck no, they do server side restrictions. And they often pay the price badly when they do not.