BigPipe Sessionless does not execute drupalSettings or JS after streaming placeholders

The main thing I'm trying to understand is why createBigPipeJsPlaceholder isn't being use in Big Pipe Sessionless. The doProcessPlaceholders function in this module does not really explain it. Why only no-JS?

/**
   * Transforms placeholders to BigPipe placeholders, either no-JS or JS.
   *
   * @param array $placeholders
   *   The placeholders to process.
   *
   * @return array
   *   The BigPipe placeholders.
   */
  protected function doProcessPlaceholders(array $placeholders) {
    $overridden_placeholders = [];
    foreach ($placeholders as $placeholder => $placeholder_elements) {
      // BigPipe uses JavaScript and the DOM to find the placeholder to replace.
      // This means finding the placeholder to replace must be efficient. Most
      // placeholders are HTML, which we can find efficiently thanks to the
      // querySelector API. But some placeholders are HTML attribute values or
      // parts thereof, and potentially even plain text in DOM text nodes. For
      // BigPipe's JavaScript to find those placeholders, it would need to
      // iterate over all DOM text nodes. This is highly inefficient. Therefore,
      // the BigPipe placeholder strategy only converts HTML placeholders into
      // BigPipe placeholders. The other placeholders need to be replaced on the
      // server, not via BigPipe.
      // @see \Drupal\Core\Access\RouteProcessorCsrf::renderPlaceholderCsrfToken()
      // @see \Drupal\Core\Form\FormBuilder::renderFormTokenPlaceholder()
      // @see \Drupal\Core\Form\FormBuilder::renderPlaceholderFormAction()
      if (static::placeholderIsAttributeSafe($placeholder)) {
        $overridden_placeholders[$placeholder] = static::createBigPipeNoJsPlaceholder($placeholder, $placeholder_elements, TRUE);
      }
      else {
        // If the current request/session doesn't have JavaScript, fall back to
        // no-JS BigPipe.
        if ($this->requestStack->getCurrentRequest()->cookies->has(static::NOJS_COOKIE)) {
          $overridden_placeholders[$placeholder] = static::createBigPipeNoJsPlaceholder($placeholder, $placeholder_elements, FALSE);
        }
        else {
          $overridden_placeholders[$placeholder] = static::createBigPipeJsPlaceholder($placeholder, $placeholder_elements);
        }
        $overridden_placeholders[$placeholder]['#cache']['contexts'][] = 'cookies:' . static::NOJS_COOKIE;
      }
    }

    return $overridden_placeholders;
  }

Uploaded a patch as POC to see if it will fail some test, but this seems to work on my development environment in my use case.
But I'm scared this has some kind of security implications that I do not see haha.

The tests that fail are to be expected, because it's still checking for the former no-js big pipe placeholders, and expecting a different render array.

Already thought about that, applied the patch from https://www.drupal.org/project/drupal/issues/1988968#comment-13618155 because we are still drupal 8.9.
That patch did not work, I'll try to reroll a more recent one then.

But why would this issue be the case with big pipe sessionless? Should drupal settings still get merged in if they are added through a no-js placeholder? But that's what seems to happening.
And why would big pipe sessionless be served through a no-js situation? Can't it be served with JS enabled?

Ok the latest patch applies fine for drupal 8.9.x: https://www.drupal.org/project/drupal/issues/1988968#comment-13739867

And darn it, it works. Updating the patch to the most recent one did it. I did thought this might be the case but thought it should work with the older version.

I thought I would have a mental breakdown, because I could not seem to figure out the issue.

But I still need to know one thing before I go to bed, because it will keep me awake if I don't. Why does this module serve it with no-js placeholders?

So it works locally, but not on our test environment.
I have no idea how to figure out what this might be, is there something I can debug on the frontend to see what happens when big pipe serves the content through sessionless?

I don't know if that would help, seeing the situation seems to differ based on the hosting environment.
Locally in a dockerized situation it works, on an online test environment it does not.
But I have a guess... Maybe something with cors?