I discovered that if I delete objects like bodyparts from my character or change my Walkspeed locally the effects also applies serverside. Does that mean that a hacker can still hack speed jump and noclip (adding notouchconstraints) on my game?
I'm not sure about the extent to which the client can modify their character, but the client does have network ownership over their character. Roblox doesn't come with any sort of native anti-cheat, so even if all of your scripts and remote events/functions are secure you still have to track player movement to check for things like speedhacks on your own.