I think that the rights have to be managed by the backend.
If you load module A, you will probably need to load some data from the backend and the backend should then refuse to send the datas to the frontend if the user isn't allowed to load the module.
The frontend will also check for the rights and not load the module on the screen, but these rights are communicated by the backend. Be aware that React, as all the other JS frameworks, are in Javascript, then the user can access and modify all data via the browser's devtools, so it's important that the backend is well secured.