The right answer here is probably that there are some apps which have a no backend, or a limited one, where the possibility of handling dangerous input exists a

The right answer here is probably that there are some apps which have a no backend, or a limited one, where the possibility of handling dangerous input exists and this provides a standard solution. Further, it's not a panacea. Defense-in-depth still applies, so server-side and other mitigations will still be appropriate. Build and use threat models to understand what is appropriate.