Any other JS could still read the encrypted data and exfiltrate it, and use it in the same way as the "real" client since they can both see and use the same dat

Any other JS could still read the encrypted data and exfiltrate it, and use it in the same way as the "real" client since they can both see and use the same data. What you are describing is very similar to how JWT already works (at least in the JWE variant which is encrypted, not only signed). If you want to save bandwidth the easiest way is to have a separate subdomain for API requests or asset requests so you don't send the cookie with asset requests. I don't think that is worth it for 99% of sites though.