It doesn't end up spamming requests the same way as in react, as there is no "componentDidMount" that can trigger side-effects. In elm it's just different states being rendered.
Ah sorry, I didn't mean side effects in lifecycle methods, I meant DOM events like click, etc. If you click a button that deletes a resource on your API, there is no time traveling because the outside world doesn't time travel along with your debugger (unfortunately). :)
You can isolate your side effects somewhere, but they still have to respond to actions/events/messages so if your time traveler dispatches actions you'll end up making duplicate requests.