it doesnt technically have to be the case, you can fake it. ie set the weapons position locally and on server and then when firing compare locations within reason.
ie you can trust the client muzzle location if its close to the expected server position.