Ultimately you should be protecting your API endpoints. It doesn't matter too much if a user can navigate to a page they aren't supposed to be on as long as the server doesn't serve them data they are not supposed to see.
Let's say you have an admin page that has a table of users or something, sure with front end code there is probably a way for them to get access to that route. The important thing is that the server checks the authenticated user and doesn't return the important data that would be on that page. Front end javascript can be modified, server responses can't by the client if no data is sent to the front end.