Bad code can be anywhere. It's definitely the exception for web apps to store data locally in a way that works though. They might try to cache a bunch of stuff,

Bad code can be anywhere. It's definitely the exception for web apps to store data locally in a way that works though. They might try to cache a bunch of stuff, but you always run into problems where 1. the cache is stale or 2. your working through something and it ends up having to hit the network anyway. But yeah, I definitely agree that it's easier to profile the network activity of a web app. It's pretty cool that you can just open the browser devtools and see all the network requests, and there's no way for a page to "fake" it. I like the web for that reason, and it's also why I leave the devtools on in the electron version on desktop (users could open it and do the same, but it's not as trustworthy, i.e. I could hack electron and fake it)