When working with web components, you will likely also end up with dependencies that you’ll install using npm (eg lit itself). Theoretically, the same supply chain attack can still happen this way and thus introduce malicious code in the web components JavaScript, see for example this article (first search result)
You could write your own ui-library using whatever technique you deem to be safe, or you can stand on the shoulders of giants and start with a readily available one and adjust as needed. Security-wise I thinking would be better to ensure the frontend and backend are separate projects/applications that could (theoretically) be deployed on different machines and still exchange the necessary information through an api, so you’ll know that even if something happens on one end, the other wouldn’t necessarily be affected as well.
Have a look at DietPi. That is a single-board-computer optimized Linux distribution that, in contradiction to what the name might suggest, runs on (almost) all of the SBC’s out there. It has stripped away all the things you don’t need and only installs and loads what is needed to run the software you choose, resulting in a very lightweight but powerful operating system for these kinds of devices. It has its own software catalog with a broad selection of optimized software, but you can of course install anything you want. Ive been running this on a Raxda Rock4 without any problems, and would definitely suggest this even on a Raspberry over the regular Pi image.