Why aren't feature flags considered a security risk in CI/CD?

It's become pretty common to handle new features by stepping away from git flow and merging them into main on the front end and hiding them behind feature flags on the client.

However, I don't see how these aren't a security risk, given that anyone using the client can see the http call to get the feature flags, and can manipulate them and turn them all on, giving them access to not-ready for use endpoints and features.

How common is this practice, and how do companies get around this issue? Do they not worry about it at all, or do they continue git flow on back end whilst feature flagging front end? Or should feature flagging be full stack?