There absolutely is. I can fetch a full user record from the database and use it to render on the server, not ideal but still secure. Send the full user record to the client and that data is now more at risk.