Worse, most if not all "REST" apps have security vulnerabilities because of how browser front-ends handle authentication.

To handle authentication "properly" you have to use cookies or sessions which inheritly make apps not RESTful.