SPA’s it’s not the traditional way to build web apps, unless you never knew other way of doing it 
APIs are excellent way to make a business move forwarded quickly in this digital era, and in the web SPA’s are usually the way chosen to do it, but it comes at a very high price, because data is now more easily extracted by Hackers, and the weekly news confirm that. Take for example the Open Banking API initiative to bring banks to the new era, it allows to build amazing decoupled products, but its costing a lot of money to the banks due to fraud they are not able to block from being committed through the APIs.
The point is, if your API is valuable for an attacker, be it financially or in terms of data, he will find the way to impersonate your genuine apps. Nowadays they don’t even try that hard to identify OWASP top 10 vulnerabilities to exploit, because often it’s more easy for them to observe how the app communicates with the backend and then build scripts to replicate the human behavior.
