There's often confusion around when to use RLS versus JavaScript filters. One method is about controlling what a specific user can see, and the other is about optimizing the user's view.
With RLS, the ISV developer controls the data filtering as part of the model creation and embed token generation. The end user sees only what the ISV allows the user to see. In this case, the user can choose to see less than what's being filtered, but won't be able to bypass the RLS configuration and see more than what's allowed.
With client-side filtering (JavaScript), the ISV might decide what the end user sees in the initial view, but they can't control changes the end user might apply to the view itself. Since user JavaScript client code can trigger data filtering on the backend, it can't be considered secure.