But how do you know that the frontend is trustworthy? People assume that frontends only talk to one backend.

Web should have thought people otherwise, but for most people it’s pretty indistinguishable from magic.