This assumes, that the client would respond with the
wrong checksum. (wich can also be hacked to always
send the correct one)

A hacker can simply alter the send positiondata, when
the server does not evaluate client movement.

The only totally save way is to do everything on the server.
(client only sends move/action commands)
But thats too slow for an FPS. (only works in a fast LAN environment)

But a server can still reevaluate a clients actions.
If something is impossible for a client to do, then simply ban the client.