The web app probably authenticates using an API as well, in which case it's trivial to add that to your shadow client as long as you have the credentials.

Laziness / skill issue.

How many apps have you seen only do client-side protection?