How would I go about protecting a RemoteEvent from exploiters?

I script a game with some friends and made the shop system where you buy figures and other things with Points. It's a GUI where if you click the buy button on a figure then it sends a signal to a remote event which then makes you spawn with the figure when you join. This worked for a while but I realized an exploiter could simply find the location of the remote event and fire it within their local script but didn't think it would happen until earlier today when I caught an exploiter type their code in chat instead of the exploit. I checked their profile and saw they had collected every figure in the game, and when I brought up the number of Points they had they had exactly 0. I only realized this because they typed it in chat so it's very likely this has happened before and I haven't caught it. I thought of doing it with remote functions but I only have a vague idea of what they do as I haven't worked with them before. Anyways, here's the script I have had since September:

script.Parent.MouseButton1Click:Connect(function()
	local player = game.Players.LocalPlayer
	local IMakeFigure = player.NAMEFigure
	if IMakeFigure.Value == false then
		if player.leaderstats.Points.Value > script.Parent.Name - 1 then
			game:GetService("ReplicatedStorage")["Figure Events"].NAME:FireServer()
			script.Parent.Parent.ImageLabel.ImageColor3 = Color3.new(55,255,0)
			script.Parent.Text = "Bought!"
			script.Disabled = true
		else
			if script.Parent.Parent.ImageLabel.ImageColor3 == Color3.new(255,0,0) then
			else
				script.Parent.Parent.ImageLabel.ImageColor3 = Color3.new(255,0,0)
				script.Parent.Text = "You don't have enough Points."
				wait(3)
				script.Parent.Parent.ImageLabel.ImageColor3 = Color3.new(255,255,255)
				script.Parent.Text = "20,000 Points"
			end
		end
	end
end)

Very insecure, I know, but since we have a fairly young demographic I didn't expect someone to do this, plus most exploits that have an explorer and excecutor cost money. So how would I go about fixing this? An ideal fix would have the server script waiting for the fire check for a value that the player can't see, but since it's a local script that fires the remote event everything is in view. I'm glad to give any extra information. Thanks.

You could use specific arguments, or disguise the remote event.

Along with this, you could have checks like the other people said, such as if someone fires a gun store event, the server checks if you are touching an invisible block inside, and if you are, it lets you purchase the gun, otherwise it kicks you.