Not necessarily, once you’ve loaded a page you can cache the page so that they load lighting fast next time.
I typically have to do server calls to load some data for each page.
Maybe I’ll get as much data on the initial server call as I can aiming to keep algorithms around .3 seconds. This might serve multiple pages. And any calls to get data will check user credentials on the server.
If a malicious user were trying to visit a different page then it wouldn’t work because it just wouldn’t have anything to display…
Of course, depends on the web app and the set up I guess. I’m sure there will be several users on the forum who have combined the speed that you get with a one page app, with the need for security and server side validation.