CBHacking

I think you're missing the point, but "every $100 bill in a wheelbarrow full of them" if you prefer.

A good question, but too narrow. What protects users from fake things of any kind? Fake messaging apps? Fake operating systems? Fake graphics cards? Fake iPhones? Fake Ferraris? Fake Gucci handbags? Fake dollar bills? Fake college diplomas? Fake homework answers? It's all really the same in every case: evaluate the trustworthiness of where you get it from; if the source isn't trustworthy then you can try to verify the authenticity (by your own knowledge, or by looking for hard-to-fake symbols of authenticity, or by consulting a trusted expert). If you can't verify it, don't accept it.

For the specific case of software, "hard-to-fake symbols of authenticity" are often things like digital signatures (though then you have to make sure the signer is who you expect it to be and that the key is trusted)... but you're better off by far just only getting your software from trusted suppliers.

In the USA I've never seen a SIM come PIN/passcode-locked. In my overseas travels I have seen it once across ~6 foreign SIMs, mostly in southern and SE asia. Phones here support adding one (and of course entering one if already present) but they don't make it obvious and most people don't even seem to know the option exists.

I'm not a lawyer, but: if you access somebody else's private data without authorization from the owner of the data, you may be committing a crime. In this particular case, the data is presumably owned by the company, but you should still explicitly make sure you have permission to decrypt and view that data.

Finally, while this isn't security-relevant, it makes developing, debugging, and modifying the scripts/mods a lot easier. Just tweak a text file and re-load the code.

Client-side JIT means the user can inspect the scripts before loading them, if desired. It also means the user can easily tell the difference between "Lua script for my game" and "arbitrary malicious DLL", which is a lot harder if the code is pre-compiled.

Hey, just to butt in a bit here: Using a scripting language with an API sandbox is a good approach, but if you want to JIT it you should really do so on the client unless you're OK with there being no way to safely distribute mods without going through your server.