So far they are mostly trusted authority rather than peer systems. But, since each player owns their own PDS state, one could perhaps just hash the previous state they are working off of. That can at least detect if a game is consistent/agreed to by both sides, allow one player to detect the other's tampering.
This would imply the game state is stored in a centralized app view, at which point the general atproto ethos that you can move your data if an app becomes bad is up to the app.
I believe the viable solution in a rich permission system is one where the user cannot directly modify a record (as defined by a permission schema for a specific app/type) and can only call methods.
So far they are mostly trusted authority rather than peer systems. But, since each player owns their own PDS state, one could perhaps just hash the previous state they are working off of. That can at least detect if a game is consistent/agreed to by both sides, allow one player to detect the other's tampering.