I suppose the only good solution is like those "game streaming services": move all the logic to the server and use the client only as a rendering device.
Even sending metadata so the client can use local sprites to render the enemy is hackable, if the end-user knows the coordinates where to render the enemy, it can immediately tell the server that "user aimed at $COORDS and pulled the trigger"...
Even sending metadata so the client can use local sprites to render the enemy is hackable, if the end-user knows the coordinates where to render the enemy, it can immediately tell the server that "user aimed at $COORDS and pulled the trigger"...