Lets say I have this frontend application that performs a login. Upon username/password sent to server, backend will make some operations to understand if the user (for example) has payed for using the service. So backend will send a response that could look like this:

{
message: "ok"
user: {
  firstName: "John"
  ,lastName: "Doe"
  ,hasPayedForSubscription: false
}
}

Based on this response, the frontend will decide if it should show protected content that is accessible only for subscribed users. Is this safe enough? Or there is a way for somebody to change the value of "hasPayedForSubscription" to "true" in order to access content for subscribed users?