There is a misunderstanding here over how server side vs client side movement work. I will illustrate this with an example:
With Client side movement, Player A sends in even intervals their location to the server. Let say they move right for 3 unit of time, the location get updated from 0:0, 0:1, 0:2. The server then relay the information to Player B.
With Server side movement, Player A tells the server they want to move to the right. The server create a path over time, 0:0, 0:1, 0:2, ... and continuously sends this to player B.
Let now add a fake lag with client side movement. In the first case the we see Player A send locations like 0:0, 0:1, -, -, -, 0:5. The server sends this to player B. If Player B fired a gun at 0:2 at the third interval they might miss because player A is not there. The server might extrapolate an virtual path between 0:1 and 0:5, but that depend on game logic.
Lets now add a fake lag with server side movement. Player A tells the server that they want to move right. After 2 units they add a 3 unit lag, and finally sends tells the server a stop command. The server would construct the following path: 0:0 (start moving player A), 0:1, 0:2, 0:3, 0:4, 0:5 (halt moving Player A). If Player B fired a gun at 0:2 at the third interval, the server see that player A is at that location and will mark a hit.
This is why server side movement isn't vulnerable to fake lag. The server has the full game state and thus know at any point where all player are and what they are doing, and if the client lag then it simply mean that their input gets delayed. Server side movement is however vulnerable to real lag, as between any action there might be a delay and thus events might not occur at the server when players want it to occur. Server side movement is also slightly more vulnerable to ddos attacks if players can identify the IP address of other players.