[joking]

Thats by design, you can’t trust the client, everything has to be checked server side.

[Clent]

I think you misunderstand what's being described. The server didn't check it, it accepted the modified hidden field. The server should have rejected the request.