I was pretty surprised, but maybe they were hoping for security by obscurity as it was buried a little in the sources. I don't think devs as a whole have really grasped a lot of the trade-offs/repercussions of moving so much logic to the client side.