If the target is moving and the shooter is moving their crosshair, there doesn't have to be a single server-side state where where shooter's crosshair is on the target's hitbox. Yet the shooter, being usually tens or hundreds of milliseconds out of sync with the server yet responding instantly to player input, might have had their crosshair right on the target's hitbox when they click the shoot button. Modern games usually still want to register that as a hit; it's a principle is called "favor the shooter". I don't see how that doesn't mean reacting to a state which the client invented whole cloth?

Not that this really matters. If you think that you could do favor the shooter style hit registration in a completely server authoritative way, we can just use wall hacks or aim bots as an example instead.