You would assume that, but you would be very wrong. People are lazier/sloppier than you might think.
Searching for "client side authentication NVD" turns up a lot of examples. There is even a CWE for "Use of Client-Side Authentication:
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments