This is a very valid question, and the answers will probably differ between developers, as many will choose different approaches to secure the integrity of their games. The choice which implementation is eventually chosen will be impacted by numerous factors, e.g. how responsive the game needs to be, how much other information is being sent over the network already, how frequently user input is actually expected, and so on.
Your general considerations are two valid approaches, of which the first is probably more responsive but also more prone to abuse. The latter is technically the other extreme on the scale, providing the most security, but with the obvious potential to slow down the game significantly, if a lot of user interactions are to be expected.
One well-known hybrid model is using a similar approach to the one you also sketched out following your two proposed scenarios, that is based on implicit confirmation. Clients send all user actions to the sever, and periodically send their (full) world-state representation as well. Clients only receive periodic world-state updates and otherwise interpolate from previously received world states locally. The server is the authority on the world state (as it is the only place where all input information lands), and will check the periodically submitted world states for deviations/manipulations and the submitted user inputs for plausibility in general.
Note that in this approach there will usually be certain divergences between the clients' world states and the true world state (due to the interpolation nature of the client update), which necessitates the server-side updates of the world state to be issued on about a per-frame basis. Of course, numerous variations of this approach exist as well, depending on the requirements of the game.