If I made a website for my client using react.js, how could he or she change the website content without knowing how to code? Is it possible to do something like the wordpress dashboard?
Website made with any technology can be changed but it does not mean that is hacked. Your logic to show/hide data determines whether your app is safe or not, e.g. if you hide a link to a protected route to a guest user but that is accessible using route url then it is bad implementation. You should restrict user to access that page and any apis used in that page should not be accessible without a token with proper permissions.