Server side AC is there to stop people doing actions that are impossible, not to stop possible actions from being automated. Server AC can stop people from moving too quickly, for example. The server knows your position, velocity, and the amount that velocity can change in a tick. It can prevent anything from going above this. It can't tell if you clicked on someone's head really quickly, or accessed memory you shouldn't be allowed to access.