You do know that it’s bullshit? Unless they’re incredibly incompetent they’re lying to you. If the data never leaves the client then all the checks are client-side, which means it’s relatively easy (compared to a server side check) to bypass those checks.