I always assumed that server_only attributes exist only on the server and are never sent to the client. In fact, they seem to be more like "client read-only", e.g. the client receives them but can't save.
Sample code:
account.setAttribute(MY_ATTR, "value", Attribute.SCOPE_GLOBAL, Attribute.FLAG_PERSISTENT | Attribute.FLAG_SERVER_ONLY);
I have a bunch of attributes that only need to live on the server (they are used to save statistics in the account, like how many games were played within the last 24 hours, the country as determined via GeoIP and so on). Sending them to the client only generates additional traffic.
If you need to keep their behaviour as it is, then maybe you can add a "true" server-only attribute type that is never sent to the client.