That's then, logically, open to exploitation from user and client-side. Unless deeper logic layers are made to prevent that.

Rabbit-hole, I tell ya. They're fun, though. :)