Your server already returns code if you are running javascript on your frontend. Your server already returns arbitrary html (which can include executable code)

Your server already returns code if you are running javascript on your frontend. Your server already returns arbitrary html (which can include executable code) unless you are running a fully static backend. HTMX moves where the trust boundary is a bit, but it doesn't change that it exists at all.