The fault of a game getting hacked is not on the ROBLOX devs. Over the past years, various services have been added to the Lua API that allow content creators to make their games safe from being edited by players. A hackable game is not the fault of the ROBLOX, but the fault of the place you're playing on.
The reason a lot of stuff is client-sided is because the game would be almost unplayable otherwise. A server tick is about 1/30th of a second, meaning that, given that the servers would be running at full speed with several thousand people online all at once (which is basically impossible) your game would lag like absolute loving hell and it would be almost completely unplayable.
In a perfect world, authoritative servers are the best solution, but in reality, with a game as complex and with as many features as ROBLOX, it simply would not work out.