Client actions need to be verified on the servers to block hacked clients injecting items, running unverified commands, etc.

It appears that realm do not verify changes in players inventories allowing people to inject hacking tools in to the game process, run commands, give items, etc.

Allowing that to happen on the client side is ok, as long as server rejects the hacked items and do not allow the commands triggered by the hacked clients to run on the world.

Using hacking tool such as Horion on Windows or Toolbox for minecraft on Android are some of the most common ways that people exploit this and make the gaming experience unpleasant on many public servers which makes managing and moderating servers very difficult. Many command blocks are required to block some of the exploits which induces a lot of lag and still not everything can be blocked using command blocks.