All server code, meaning everything that is in scripts/server/* folder is not used by the client's local installation, but packed and send from the server to the client, so changing those scripts on the client will not do anything.
So it should be cheat proof. A more difficult case would be client commands to server where the server has code for, I don't know how this will work, but you could just test it.