How would I go about protecting a RemoteEvent from exploiters?

I script a game with some friends and made the shop system where you buy figures and other things with Points. It's a GUI where if you click the buy button on a figure then it sends a signal to a remote event which then makes you spawn with the figure when you join. This worked for a while but I realized an exploiter could simply find the location of the remote event and fire it within their local script but didn't think it would happen until earlier today when I caught an exploiter type their code in chat instead of the exploit. I checked their profile and saw they had collected every figure in the game, and when I brought up the number of Points they had they had exactly 0. I only realized this because they typed it in chat so it's very likely this has happened before and I haven't caught it. I thought of doing it with remote functions but I only have a vague idea of what they do as I haven't worked with them before. Anyways, here's the script I have had since September:

script.Parent.MouseButton1Click:Connect(function()
    local player = game.Players.LocalPlayer
    local IMakeFigure = player.NAMEFigure
    if IMakeFigure.Value == false then
        if player.leaderstats.Points.Value > script.Parent.Name - 1 then
            game:GetService("ReplicatedStorage")["Figure Events"].NAME:FireServer()
            script.Parent.Parent.ImageLabel.ImageColor3 = Color3.new(55,255,0)
            script.Parent.Text = "Bought!"
            script.Disabled = true
        else
            if script.Parent.Parent.ImageLabel.ImageColor3 == Color3.new(255,0,0) then
            else
                script.Parent.Parent.ImageLabel.ImageColor3 = Color3.new(255,0,0)
                script.Parent.Text = "You don't have enough Points."
                wait(3)
                script.Parent.Parent.ImageLabel.ImageColor3 = Color3.new(255,255,255)
                script.Parent.Text = "20,000 Points"
            end
        end
    end
end)

Very insecure, I know, but since we have a fairly young demographic I didn't expect someone to do this, plus most exploits that have an explorer and excecutor cost money. So how would I go about fixing this? An ideal fix would have the server script waiting for the fire check for a value that the player can't see, but since it's a local script that fires the remote event everything is in view. I'm glad to give any extra information. Thanks.