If my Apex client tells the server I got a perfect headshot, how would the server know I didn't fake the data?

Any game that works like that is fundamentally flawed and AC is nothing but an attempt at a cheap bandaid at best.

The client should be doing nothing but rendering and sending player actions to the server and the server should be managing the game state as well as running its checks on those actions. And when one client sends actuons that are weird and doesn't line up with it's internal game state it should kick the client immediately always deferring to what ITS game state is telling it, not the client.