Client can only call RPCs on actors it owns. It is a security measure, preventing clients from commanding other clients’ actors. Initially, client only owns its PlayerController. You can then establish (on server) ownership chains like:
A pawn owns its weapon, PlayerController owns pawn. Thus, PlayerController will own a weapon and will be able to call Weapon::Fire().