but what if the game gives 1 point per hour that the game is closed..
and what if the player manually changes its phone time to 2030
the player can 'hack' the game this way?
They probably could, but you could potentially get around this by getting the time from a server instead. This would require the application to connect to the internet every time it opens, but other than that I'm not sure how you'd get around the player manually changing the time on their device.
You could try using Google's public NTP server and parse it using something like this article (written in C) . It would need to be translated to GDScript, or you could use GDNative.
I found a link to the article here, where someone asked how to use Google's public NTP programmatically.
I have no idea if you can use google's NTP server commercially though.