So I'm having a website which uses a couple of AJAX requests which fetch data from the DB in an array in PHP, and then generate the markup accordingly needed on the frontend within PHP, then deliver that to the client, and insert it into the DOM using js (simple targetElement.innerHTML = responseFromServer principle).

What I want to do now to be more compatible with non-web interfaces (such as ios and android apps) is adapt these AJAX calls to exclusively output JSON responses. And consequently change the js client-side code to generate the according markup upon reception, with stuff like createElement(), appendChild(), etc. In this case, some people told me that this could be dangerous, in terms of the security of the webapp. I could not understand these reasons; so what are the risks of generating HTML content on the client-side in js, using a JSON response, instead of directly inserting a thus on-the-server-generated-HTML into the DOM?