Generally speaking for weapons in a multiplayer game, you don’t want to assume that the server’s state is completely up to date like that. While it’s true that for the most part “never trust the client” is the rule, the vast majority of multiplayer games out there make some compromises on this for game-feel/fairness reasons.
In a networked game, especially over the internet, your guarantees that the server state will be anything close to a fair representation of your client state are somewhat limited. (For many reasons, latency being one, the frequency with which the data is sent being another, and also how accurately the server can possibly reconstruct that data based on what you actually sent). This is especially true for aim transforms, which are typically going to be very noisy data that changes unpredictably from frame to frame (especially if players are aiming with a mouse).
Typically when informing the server/host that a client fired a weapon, most games will send some information along with that RPC to allow the server to create some kind of fair reconstruction of what happened on the client. Obviously you have to be careful about cheating here, but it’s pretty common to send out information like “this is the entity that was hit by the player’s reticle raycast that frame, and this is how offset the player’s aim transform was from some known point on that entity, such as a bone or the root. If that raycast didn’t hit an entity, then we were aiming for some point calculated based on the muzzle transform and the max effective weapon range”. Then you could have your projectile fire towards that point on the server.
Alternatively you could send the actual muzzle transform from the client, and the server could either fire directly from that transform (which could look bad if the client/server states have diverged a lot, and possibly be open to cheating unless you put some sanity checks on it), or we could use that to figure out where the client was aiming (e.g. MuzzlePosition + MuzzleRotation.ToVector().Normalize() * WeaponMaxRange), and then have the server aim at the same point.
Basically it’s all a big compromise between making the game feel good and fair on the client, making it hard for people with hacked clients to cheat, and making the game feel fair to other players.