Not sure how that's the case since authentication and data governance is done by the server. This is just the difference between thin and thick client models. A

Not sure how that's the case since authentication and data governance is done by the server. This is just the difference between thin and thick client models. Any app on a phone is a thick client as well, and uses exactly the same model as SPA.