Why is properly verifying a genuine purchase receipt on your own trusted backend server considered an important security best practice, rather than simply trusting the client side purchase confirmation alone?

Since a client side app's own reported purchase confirmation could genuinely be manipulated or completely faked by a sufficiently determined attacker, such as through a modified app or a genuinely compromised device, properly verifying that particular purchase's own genuine authenticity by sending its specific receipt directly to your own trusted backend server, which then properly and independently verifies that same specific receipt directly with either Google's or Apple's own official respective server, ensures that premium content or a given specific paid feature is genuinely only actually and properly unlocked for a user who has genuinely and legitimately actually paid for it, rather than potentially being unlocked through some kind of client side manipulation instead.

// Client sends the receipt to your own backend
// Backend independently verifies that receipt directly with Google or Apple's own official server