[rdegges]

Unfortunately, most SPA apps don't have a server side backed and thus cannot benefit from the additional security that the Authorization Code flow provides.

[idubrov]

They are in the same category as mobile apps in that respect, no? Both of them are "public clients" in terms of OAuth 2.0.