Firebase Firestore with Android: Should Critical Security Logic Run on the Frontend?

Scenario:
We use Firebase Cloud Functions, which delays account balance updates for security. How can we show immediate UI changes while the backend confirms the transaction?

Considering the inherent security limitations of frontend logic, it is important that critical security checks remain confined to the backend. In my experience with Firebase Cloud Functions, implementing optimistic UI updates can significantly improve user experience without compromising security. The strategy involves visually reflecting the transaction immediately, while concurrently awaiting backend verification. This approach allows for a responsive interface. However, it is crucial to gracefully handle any discrepancies if the backend confirmation is delayed or fails, ensuring that the optimistic update is reconciled appropriately with the final server state.