I'm not really into query_client_cvar.
First, it's resource expensive and slow method.
Second, it's asynchronous ... what's not that bad really.
Third and most important reason is that you need to call it really frequently to make it efficient for what you're doing. If you want to protect your KZ server from people using edge bugs with ease @ 20 fps, 3 sec is not enough. You can bind "fps_max 20" to a mouse key, use it just before hitting the edge and plugin will turn it off after 3 secs what's more than enough time to exploit. Calling it with 1 sec interval wouldn't be enough.
The most effective method I've came across is using aliases to block certain client cvars in combination with query_client_cvar, which is called once though. Only downfall is that for aliases to wear off, users need to restart the game.