Need clarification on handling exploits from client?

Yeah so exploiters will be able to see all the code on the client and will be able to sniff out any requests you do to the server. You should not trust anything from the client, exploiters can put in their own data. To prevent these things you use server sided checks which basically happen on the server when you receive the request. I will give you an example of how I would make a team change that requires you to have 100 money.

Client:

local event = workspace.Event
local player = game:GetService("Players").LocalPlayer

if player.leaderstats.Money.Value == 100 then
	event:FireServer() -- Exploiters will be able to fire this remote by itself so we can't be sure our client side check (the if statement) will work
end

Server:

local event = workspace.Event

event.OnServerEvent:Connect(function(player)
	if player.leaderstats.Money.Value == 100 then -- This stops an exploiter dead in their tracks, there is no way for them to combat this because their money HAS to equal 100 on the server.
		player.Team = game:GetService("Teams").BlueTeam
	end
end)

So I will first check on the client side just to verify if they have enough money on their client so we don't have to strain server resources if they don't have it. You would also want to do this if maybe you wanted to add visuals that only showed up when they did have enough.

Now on the server I use my server side check to verify the player's request through the information stored on the server that can not be changed by the client. The whole "FE thing" starts to make a lot more sense now since the client can not replicate their illegal money change over to the server effectively stopping them in their tracks.

A lot of poorly designed scripts won't use this system and wont check on the server so an exploiter can simply fire the event and get what they want.

TL:DR: Never trust the client, always perform server side checks. An exploiter can see everything that exists and happens on the client.