Yes, this is true for any js framework (and most libraries) to be honest.

If you want something “safe”, nowadays the only option is to use one of the big MVC frameworks (django, laravel, rails, etc...) with inertia.js, if you want to use React or Vue.