Would it be safe to put all cosmetic geometry on the client to prevent Asset stealing?

By prevent, I mean would a exploiter be able to retrieve geometry even when I detect his injected script, delete everything from the client side, then kick him?

Yes, exploiters can use memory viewers and memory editors to find and manipulate the contents of their client's memory. Although the Roblox client relies on a memory checker to detect most exploits, the memory checker is not perfect.