Why does editing the client's memory in some MMOs allow them to cheat?

Why editing the memory of the game client works? Why so many "Hack protection" tools coming with the clients?

If I were to design a client-server game, everything would happen at the server (the simulation of the game world) and clients would be only passive consumers receiving status updates of the part of the world near their characters, sending only some information like keystrokes or move/action commands. Maybe I missing something here, but with that design, any hack like raising my STR by 200 in the client memory (if the value is present at all), just won't have any effect.

The only explanation I can think is that games in which memory editing works let parts of the simulation run in the client and the server then just synchronize all the clients periodically. I can understand that design for Real Time Strategy games with a fixed number of players once a match is configured, but, why in MMORPGs? Is it a strategy to reduce server load?

Answer

While ideal, it is practically improbable to validate every single input against the server, both in terms of computational load and latency in input confirmation for the client.

Consequently there are usually a handful of things that aren't validated on the server in many MMOs. In some cases this includes certain classes of character movement, which is why teleportation and speed hacks exist. Client-side protections help provide an extra barrier to those hacks, although of course with sufficient time they can be bypassed. To combat this, many such games would employ a strategy of logging and after-the-fact verification and rotation of the actual protections employed.

There's also the issue of screen other simple memory-scraping hacks that can collate information and transmit keypress and other input back through the client faster than a human can normally react. Or they can look for information that may be transmitted to the client but not necessarily visible yet (such as the positions of creatures that are close by but not displayed anywhere yet, as was common in early Diablo map hacks).