I think the way it works is the scripts are client side just to facilitate the playing-out of a battle, the server still (hopefully) validates
everything, and communicates only the bare-bones of "what just happened" to each client which then use the scripts to process the visual-side of things on the client (such as weather mechanics, etc).
I think a similar comparison would be with SC2 replays, which I
think are just re-enacted out on the client. Might be wrong though.
Technically this could cause two clients to become out of sync if one was using modified scripts, so for instance one end might display a pet as having 200 more health than it should, but as long as the server doesn't trust the clients in any way then all's good. I hope.
Meanwhile, at Blizzard...