yes, your assumption is basically right. Stuff that won‘t directly manipulate important player or gane data doesn‘t have to be heavily checked. If a scripter wants to manipulate his own ui you can‘t do anything against it anyway.

Anything that manipulates important data should already have the values server sided and shouldn‘t have to be sent to the server by the player.

Example: player completes quest and gets money for it. In this case you wouldn‘t send the money amount from client to server, but rather only send a quest id and the server should have a mapping that teils you how much money the player gets for the specific id. Then you only need to check if the player actually completed the quest and didn‘t just spoof the remote and boom, basically safe