Just to add something fairly straightforward to this:
- The game is hosted by Rare, none of us are hosts. This means that host side manipulation should be limited to Rare (or people they hire to do it);
- The client should not be authoritative in a broad sense. Latency interpolation beats 'trust the player' in terms of anti-cheat;
- EAC, GameGuard, Vanguard and so on, have already been defeated in other products. (Vanguard's most recent issue is in recent news.)
While I'm already exposed in other games, most of those games have a player as the host; most of the games are designed to prevent people cheating as the host. The problem here is that the client is obviously getting data and/or allowing inputs which don't make sense. Given the experience of a few people I know (Starlink and/or other semi-unreliable internet connections), it feels incongruous that a client's state is being trusted. Cross-region play also suggests that the client isn't authoritative (it's not 'smooth' likes other games using 'trust the client' are).
The net result is leaving me questioning if EAC is just trying to provide an access barrier to cheating, rather than fixing the problem. Yes, I'm less uncomfortable with it than others might be, but it feels like a short term, and largely ineffective, solution. Due to the size of Sea of Thieves, it feels like it'll make the game a target for malcious actors. Maybe I'm wrong on that (I'd like to be), but I'd have thought that working on technical debt and fixing the clients performing tasks(/executing commands) they shouldn't would have made more sense.
