There are cheat tools that work at DirectX/openGL level and check for the meshes transforms and it has nothing to do with the Client/Server model.
Agreed.
(UE4 MP dev here. Indie, but yeah.)
It completely does (For wallhacks and enemy health visualization)
Character position is server-broadcasted, and so is character health.
Client movement prediction is not a problem, just an offset in the visualization check.
An issue could be present if the dedicated server is not actually loading all visualization-blocking geometry, and just collisional shapes.
Aimbots are
much harder, admittedly, and perhaps they're using wallhacks as honeypots, but it's possible (if hard) to prevent wallhacking in
most cases.
Phantom bones and dynamic bone renaming could prevent the driver-level hack, but nothing is stopping OCR or other advanced methods.
Enemy healthbars \ cooldowns, there's just no excuse. Non-owning clients shouldn't have that information, period.