The API Churn/Security Trade-Off (2016) (intercoolerjs.org)
TLDR: Heavy client-side logic requires a trade off between API churn or an increasingly complex security model