As @ianb says, a user object is a database table row, in table Users. Like all table rows, it’s passed back to Server code by reference, i.e., by row id.
So, the only way that Client-side code can “fake” a user is by creating an actual row in the Users table. By default, Users is not accessible to Client-side code, so (if you left that setting at the default) it can’t do that.