The languages themselves are not necessarily more vulnerable. Most flaws are not results of the underlying language, but of the various logic checks, input sensitization, etc.
That said, you cannot control the code client side, which means that the local user can modify it. It can also be modified by man-in-the-middle attack on the network or by a man-in-the-browser attack where the attacker has compromised the local machine/browser.
On the server side, they would have to break into your server to modify the code. However, that does not mean the code is necessarily more secure.
Now, to your last point. You should ensure all of your security checks are performed on the server side because you cannot trust client-side validation since it only affects what's going on in the browser. An attacker locally or MiTM can still change the raw HTTP traffic, which would result in your client-side validation effectively being ignored. Client side validation is a convenience for your users and to save some cycles on your server.