Not really comparable tho. In React, the JS in the HTML is to make loops and conditional rendering, i.e. presentational logic, like in any other templating system. In PHP, you can embed business logic and database accesses in the HTML.
Well yes if you're stupid enough to directly expose your DB to the world then it's technically possible, but barring such idiocy there's arguably more risk of a DB hack through PHP than client side JS in most architectures.
Funny, that is React/JSX's biggest sell