I have never received a penalty, before I have entered the pit lane, and I don't see how this is possible. Doesn't the host get X, Y, Z coordinates in the same time it gets the speed, direction, heading, etc..(much like the same way the insim apps receive it)? And if that's so, then I can't be sure how authentic this screenie is. You can always have a penalty before that and head for the pit lane.
And, yes, making penalties be dealt on client-side would definitely make it vulnerable to hacking.