I know clients can't access server scripts and can access local scripts but what about ModuleScripts?
Yes, a client can access a module script. However a client can NOT require the module script.