If web sites have to so dynamic, I much prefer that the computation involved is done on their machine than on mine. I simply don't trust random web sites enough to let them run code on my machines.
As to what harm I'm avoiding, it's mostly around tracking -- which is something that browsers have a very difficult time preventing, especially if sites are allowed to run code in them.
You trust uploading your personal information to a server to generate the pdf/image/whatever vs doing it in solely in the browser?
Doing more on the server would lead to more tracking, not less.
There have been plenty of sites that have lied about such things.
The point is the more work the server does, the more data you have to send them to do that work.
As far as trusting it's client-side only, opening the network tab in devtools would suffice.
If you think they broke the sandbox (Google would pay millions for that!), yes sniffing would be the next step.
At least you have a sandbox on web, you usually don't have that for native apps.
But that's all better than willingly sending data to another entity's server and trusting them to not abuse/leak it.
What I have for native applications that I don't for the web is the ability to firewall off the native applications.
There you're placing trust on the firewall's sandbox. Are you sure the application can't communicate with the outside at all? DNS exfliltration for example?