> Even in a browser, a compromised JS payload can put your user's data and privacy at risk.

True. In a backend, however, a compromised payload can put all of user's and your non-user data at risk.

> your non-user data at risk.

That sounds like a GDPR fine waiting to be issued right there.