What's implemented wrongly is the idea that this kind of client side check somehow removes the need for server side verification.

And the idea that this kind of check can't be defeated.