That's why you don't put your logic in the client, especially not JavaScript.

Arguably Photopea made a mistake, and now they are paying for it.

They can fight, but it's a losing battle.