Yup, that happens.
A thing to consider is that the dev tool is used by the browser, does not exist in an app form.
Several things to consider regarding the POST action:
You can and should obfuscate the variable names in the links (POSTs), or at least use things not overly obvious (userid, password, etc).
And perhaps add some extra values, also obfuscated to act as decoys/fakes.
You can encrypt and or encode the variable post values within your code which the server knows how its encrypted and decrypts it on received.
You can add double checks like a MD5 hash between 2 posted values, or even from 2 combined values (1 from a previous post) and check the hash server side again.
You can add several methods of increasing values that do not correspond with numbers.
A returned value double check, where the received value is send back to the app and double checked.
A check server side that tracks 'irregular' values versus expected values. (i.e. normally only 5 points gets added, suddenly >100 gets added)
And a lot more options to make it harder to manipulate what is send and what is accepted upon reception.
It will never be 100% safe, but in reality, that goes for most information online, it's generally a matter of how much effort was poured into protection, and how much time and energy an abuser is willing to spent to make hos hack happen ....