Is serverside anti-cheat too difficult?

Not at all, you should never trust the client as they can spoof. But you can't install malware or harvest data as effectively from the server, so shady companies generally don't try it that way.