A cheat engine will change the value of the variable on local machine, however it can’t affect the value on server, so if you make the buy operation on server, regardless of what shows local machine the variable will be true one on server.
SyncVar syncs the variables from server to client (single direction only).
It really depends on how you’re writing your code and your DB backend can affect this process too, there’s no standard way to do it so can’t really help much.
All I can say is that you can use command or networkMessage to send the buy request, on server you validate the request then perform it and send RPC/networkMessage with the operation state (success/failed)