> but it seems like you still need a backend

Of course. It's just managed by someone else and you often are paying per usage. And you'll find yourself needing to wrangle numerous serverless platforms to actually build out relevant business logic if you want to do something meaningful, one third-party microservice at a time.

> Also, because it's just a static site, there's no backend or database, so you get better security.

It's not as trendy to think of it this way, but "static sites" are just caches with manual invalidation.