From a security perspective I greatly prefer a client-server approach: you have an unsafe frontend where you care about ergonomy and aesthetics, and a backend which provides an API which handles the security.
Two different worlds and often two different kinds of developpers
I think we actually don't disagree there, but we have a different understanding of the term "server-side". Anything related to security must happen on the server since safety measures in scripts running client-side can be defeated.