TheUnknownfactor, co-author of Z-Block, a cvar blocker for the Source engine had an interesting discussion with Valve's main developer Alfred Reynolds about the new restrictions from server to client:

I've recently had some contact with VALVe in regards to zBlock and cl_restrict_server_command, I haven't gotten any concrete "we'll remove it or default it to 0", however I did get an "we plan to add some of zBlocks functions into SrcDS.

I'll start quoting emails where it becomes relavant, so I'm skipping a bunch of other stuff.

“Can you give me any details on what a "rate hack" is exactly? Are users changing there cl_cmdrate on the fly and causing bad server behavior? We want to protect servers from this problem directly in the engine.
- Alfred”