Yes, SPAs aren't required but they make it more likely that the site will use AJAX to request data instead of rendering the page with server data PHP-style.
I work on some SPAs and some server side rendered systems.
It's so nice to fire up the network tab and see some of the requests right away to troubleshoot.
Server side rendered stuff, not so easy. Not impossible and you can always add some debugging, but the nature of SPAs to just call all the things that are easily seen, very nice. And I can use that elsewhere.
99% of the time, not great, everyone codes their connection points as if their beloved JavaScript function is the only caller.
I always take care to not trust raw user input, and add rate limiting and request size limits. I'm sure there is more I can be doing, but this is not my area of expertise.
- Assume that the caller might not be a browser, so don't assume anything regardling workflows between calls.
- Keep up to date with OWASP, https://owasp.org/