They can't. Of course, they can't really do it on a remote server either but they choose to pretend they can. If they really wanted to, they could run it through a machine learning system on your phone and just send the result to discord. That wouldn't be secure, strictly speaking, but it would be good enough for this purpose. The kind of model they could send to a phone wouldn't be very reliable, but that's the problem they have anyway so nothing of value is lost

They can absolutely run the verification code client side, but they can't really fully trust the data being provided from client side since the client might be manipulated or a 3rd party client may have reverse engineered the API to bypass the verification.

Probably they made the decision that it's worth it to protect privacy (you know the thing people have been complaining about) weighed against that most teens probably won't figure out how to bypass the system.... which makes this sudden change (trial?) where it's being sent to a 3rd party anyway kind of odd.