Yep. A lot of what Lithium and B&N does could almost certainly have been done more efficiently server-side. That looks to be especially true of the Coremetrics scripts I mentioned above. Sometimes such choices get made simply because the developers on the project know one technology better than another.
And sure, there are plenty of examples of websites that rely on client-side data validation alone. But no competent professional developer would ever do that. Plus, there's a lot of really crappy, insecure server-side PHP code out there too.
The root cause of the problem is that it's rather easy to become an amateur programmer. You can find lots of examples and tutorials on JavaScript and PHP all over the place. But they almost invariably are about amateur, hobbyist-style coding. Professional coding is a completely different animal, and most amateurs don't even realize it.
