Server RPC Not Work In Client, is Engine security issue?

Continuing the discussion from [Server RPC Not Work In Client Widget]
(Server RPC Not Work In Client Widget):

I still haven’t been able to resolve the issue posted in this topic, but after searching the forum and thinking about it, I found one difference between the InventoryComponent and RuneInventory.

To be short, Could it be a security issue that, when the attachment is spawned in BeginPlay() without an Authority check, the engine may be ignoring calls to Server_TransferSlots() from the client to the server?

The InventoryComponent that the player has is created using CreateDefaultSubObject() in the constructor, while for Attachment, an ActionComponent is created in the player’s constructor. In the BeginPlay() of the ActionComponent, Attachment are spawned using SpawnActor() based on a separate DataAsset without performing an Authority check. This spawning of Attachment occurs both locally and on the server.
Then, this Attachment creates the RuneInventory at the construction stage.(but isn’t important.)