Because they are projectiles, and projectiles function on both clientside and serverside. Clientside handles the visible route of a projectile(what you see) and the serverside handles their movement and interactions(so secure). Can't do this with things like bombs because bombs have timers that need to be synced between all players(so you can't let players see their own thing) whereas projectiles are simply spawned and fly straight, which is extremely easy for the client to predict/sync.