Rendering is not what you are doing server side.

No shit sherlock. Rendering requires information about the game, and that information is enough to allow cheating. Aimbots don’t need to perform “invalid actions” in order to wreck a game. They just need to be faster and more accurate than most human players. Trying to heuristically detect aimbots is also commonly used alongside other anticheat methods, it just doesn’t work (unless you have people manually reviewing individual reported cheaters, but companies try to avoid that because it’s expensive and risks false positives).

Ultimately you either have basically google stadia (with all its technical problems) or you are trusting the client to render the game.

Even if the client only has exactly the absolute minimum amount of information needed to draw all the things that are visible, that still allows a cheat to see the player coordinates and the coordinates of visible entities, which usually makes eg. an aimbot trivial to make.

“Never trust the client” renders entire genres of games inaccessible for a big corporation. But those genres have billions of dollars of potential profit in them. So they will go as far as they can to make the client almost trustable. The average player of a first-person shooter doesn’t really think about the implications of kernel-level anticheat at all so it’s not a hard choice for them. 95% of them are on windows after all and that already gives kenel access to their PC to some entity they really have no good reason to trust.

it’s

while (true) {
    let t = Date.now();
    if (timeoutMap.has(t)) timeoutMap[t]();
}

of course. Clearly O(n).