Not exactly, he could be correct.
Say if you were to make a add-on where if a player runs into a wall, he starts climb upward.. Now if this was client-sided and you sent fake information, you pretty much could fly.
if sending fake information could let you fly, holding buttons could let you fly
notice, he only ever said the state of moving forward/backward would be sent
all the actual calculations with that are done on the server
why would you let the client manually say "hey I'm moving up :D"