Good question While the “secondary world” is local and not replicated by UE4, you are still able to communicate with the server. For example, to have the changes done in your local inventory replicated to other clients, you MUST pass through the server (we have a complete working sample of this that will be release soon - you can see it in the video). The server will then make the usual validations that you would do normally (so - from a security point of view of a multi-player session - it’s not different than a local code-injection attack done in a common network-replicated use-case).
You’re right: switching between worlds is a matter of only 1 frame. If you pre-load the needed “secondary worlds” in advance, they are kept in memory and the switch is done in 1 function call. In this case you must of course pay attention to the consumed memory (background worlds are “paused” by default, so they doesn’t have impact on run-time performances).