Author here: Only a few years ago the idea of the browser connecting directly to a cloud database was considered unthinkable from a security standpoint. Now backend APIs are used directly by browser and mobile apps everywhere.

Has anything changed other than developer's comfort with connecting directly from the browser to the backend? Mobile apps are common, and single page applications are accepted. In my experience moving to a simpler stack is good for security.