I use pages router with supabase and have set up server side auth as described in the documentation.

I have a general question about whether I should use route handlers. From supabase itself, I can't find anything to the contrary, for example, logging in on the client side (like the documentation says). Changes to databases are also currently client-side. Is there any problem with it? Is it a security risk or something similar? Currently all I see is code. I missed something obvious?

Or should I always do it depending on the situation? So login on the client side and update a database, for example via an API?

I don't need a specific answer, but rather tips for best practices.