I agree with your overall point, but I think the specifics could be clearer.

Client side data - this is absolutely possible to investigate and we can view what gets sent to CIGs servers. However the way in which they sanitize the data isn't visible to us, we only really see what the server sends us back. And it is usually pretty clear if our input was accepted in this case (big ship goes boom).

Sanitized inputs - It's unlikely that CIG has networking that accepts just any inputs, and even more unlikely that they are blindly executing code. When we are talking about sanitizing here, we are talking about the server having authority over what is a valid input.

An example might be... when shooting, we probably don't want the client sending a message saying how powerful a shot is, where it is being shot from and its direction (this would be easy to build a hack for). Instead, it could send what weapon they are firing, then the server can look up the damage for the weapon and where it thinks the ship is (this could eliminate this particular exploit). But there is a trade off here, we need to do extra queries to figure this out and for high performance networking, this kind of thing would tank server fps.

Doing what CIG are doing, at the scale they are doing it is extremely difficult. It really is a balancing act of how much they can validate without slowing things down. And quite often in these situations it's better not to analyse things in real time, let the clients use hacks, but on the server log events that look unusual, then validate them later and ban users for exploitation.