An easier way to reason about the modern web, and port this knowledge from and to native platforms at a minimal cognitive cost, is to think about a web applicat

An easier way to reason about the modern web, and port this knowledge from and to native platforms at a minimal cognitive cost, is to think about a web application as consuming from an API or database layer which already enforces authorization and provides authentication, instead of mixing all these things in a single request. Once you do this, the idea of duplicated authorization goes away, as the only thing you are doing on the front-end is error representation (and focusing on the design). Then, you pre-build, or run+cache this same application on the server side to pre-render pages for search engines, first page load, accessibility etc. so that you are actually delivering an application for the semantic Web. Viewed from this angle, it does not really involve more steps, but it does create more separation of concern. This in turn allows more specialization, scaling, and is more secure. You can apply this approach to build very simple pages (e.g. blog consuming data from Markdown files), which are not SPAs, but are very easy to turn into SPAs. So it's not really that SPAs are this hard, it's that the "do everything in one request" thinking is still very pervasive and making it harder to reason about building modern websites in a simple manner.