SPAs can be JAMstack or non-JAMstack. JAM is secure as fuck when there's no 'A' or when you trust the 'A' strongly. (e.g. Google Maps API) Otherwise, you're just making security someone else's problem.