Apologies for being vague. Regarding the SSL certificate, I was referring to modern browsers refusing to load "unsafe" assets.

When the JS can't load, JS-heavy apps tend to either be raw templates (i.e. full of {{ statements }}) or completely blank (if the templates were going to be loaded in a separate request). As Isofarro said, non-JS pages don't suffer from this because the content is there in plain HTML.

Less dependencies, a reduced risk vector. Just the HTML page containing the content needs to load.