What meets your e2e standard? You can always corrupt the client, even an update in a mobile app. I agree JS is more vulnerable to extensions attacks or XSS or supply chain of some other dep you included.