John_Banana It's a client quality thing. If a server owner sets a client's fov in a loop for some reason its likely that client will come on to the forums and discord and complain about an fov bug not realizing it is the server doing it. This would hurt our reputation because now people think our game doesn't let you set fov when we claim to allow it.
Have you actually looked at what the saved dvars entail? They are stored in a file in %localappdata%/Plutonium/storage/t4/players/plutonium.cfg or plutonium_mp.cfg. When these dvars' values are set they save to these configs even if set by setclientdvar(). So a malicious server owner could set any of those dvars and then they save to that player's config file if we didn't patch setclientdvar() to respect the config file.
There really isn't much reason for you to write to dvars saved to the config file. Like r_fullscreen, r_mode, r_monitor, r_vsync, snaps, cl_voice, vid_xpos, and vid_ypos are examples of what is a saved dvar. It doesn't make any sense for a server owner to be able to modify these on a remote client.