Basically nothing is safe when it originates from a client but the client still need to convey their intent to the server obviously.
The server needs to do its own sanity checks of the input it gets from the client and reject it if it doesn’t comply with the constraints you make.
Since you just started diving into multiplayer you have many other concerns to focus on first just to ensure things are in sync to begin with.
Fighting cheaters is a battle that is pretty much impossible to win if you don’t use dedicated servers or have a team of developers and testers to help you find holes in your programming.