I've heard that some people build UIs with thousands of dependencies, in JavaScript that hits the server for text that is then parsed to object that are then passed through all sorts of classes that each spit out HTML. They also do some weird stuff with events like key-ups in order to re-render input fields based on objects rather than letting the browser manage those kinds of things. Sounds pretty weird to me.
They generally don't spit out HTML, that's how you get XSS. Rather, they turn the data into DOM nodes, dynamically. In theory, that's more efficient, because the data should be smaller than the marked-up data. That's also how you get a UI to sort of rival a Desktop application, you cannot do this all server-side.
Also, all your server-side code that renders HTML is usually more privileged than your client code, unless you did your job very well, which I know you didn't, because you don't have the time and/or money. That's a huge risk surface area. There's a reason why Wordpress instances (which also have "thousands" of components) get hacked all the time, while static-site-generator sites don't.
> They also do some weird stuff with events like key-ups in order to re-render input fields based on objects rather than letting the browser manage those kinds of things.
The browser doesn't manage those things, or if it does, it's very limited and likely different for each browser. You need some amount of Javascript for all but the most trivial forms.