While I understand the difference between authoritative and NA, and the principle of not trusting the client, implementing authoritative and all the minutiae you need to actually get it working reliably with a predictive client isn't simple and easy. If you don't predict, you suffer lag issues, and if you do, you have to deal with rewinding etc blah blah. Perhaps there's a drop in solution for Unity these days that works reliably, if so I'd love to hear about it.

Your approach with making unit tests out of it does sound pretty good (id really love to start using unit tests more in my game code, but beyond a few sanity checks I dont do much currently) - although time consuming and would probably need to be carefully constructed to avoid needing frequent rewriting. Would you call CE to perform the exploit part of the unit tests, or write your own directly in your native language? If so, what about compile changes to the address etc? You'd really need to write something to dynamically determine the address (in CE or in your own code) - or would you just fake CE by changing the variable CE is changing manually?

Everything points to Dave not having a very strong understanding of the fundamentals.

I'd suggest that he wouldn't have a top VR multiplayer game without a fairly decent understanding of the fundamentals. However, I dont know what 'everything' refers to here, I can only comment based on what I've read in this post.

I genuinely think he just didn't know how to do this.

I think its more likely he knew of the various multiplayer options, and, like many other developers, went with the one that was easiest and quickest, so he could get on with actually making the game.