To be fair, doing it client side like this is so much easier than setting up all the rewrite rules server side. It's actually kind of funny he chose the least complex route here considering everything else about his site is overly complicated.
This kind of redirect does not provide the same benefit. An attacker could just tamper with the JS to remove that code, and this could happen on any visit, not just the first.
There are multiple solutions and all of them are even simpler than what he picked.