It really is as simple as "don't trust the client." Just assume that everyone is trying to cheat and go from there.

Servers should know what valid inputs from clients look like, and aggressively validate and profile those inputs for cheating. Meanwhile, the server should only send data to the client that is needed to render a display. Everything else stays server-side.

The key is to build a profile of invalid activity, like inhumanly fast mouse velocity coupled with accurate kills. There's an art to this, but for things like FPS games, the general envelope of valid user activity should be straightforward to define. The finer points get caught during QA, and then further refined post-release. Someone might even come up with a library for this if there isn't one already.

As a bonus, this also catches situations where people are using kernel circumvention like external hardware, in order to cheat. The behavior as seen by the server is what ultimately gets flagged.