You know it's always a concern, but context is everything.

> small little one-off apps that might need _some_ backend functionality

The security implications of serving a static website vs. a dynamic application that processes payment and queries the database are two different beasts