First rule of game security: don't trust the client. The client is in the hands of the enemy.
If whether or not you get hit isn't verified server-side, then it's just a matter of time before someone comes up with a cheat program to make it so that they never get hit, or perhaps rather, that hits don't register. At that point, you could make a macro that sloppily wanders through levels hacking away and getting hit a lot more times than you hit mobs. But eventually you kill them, because when you get hit, it doesn't register. And then you can macro entire levels and run up massive loot that way. See the problem?
wouldnt this mean they would have to recode the whole game to accommodate this?