They could, but most hacks I've seen for TSO have been client-side. I assume crafting is a mix of both, since it requires the user to be present. Again, I haven’t gone through the mechanics yet.
Well, object you want to upload is local but once it's crafted, it's on the server, regardless of who's inventory it's in. So, the inventory is server-side as well.