Do I need a backend at all for a Lovable app with Supabase?

Both are right, depending on one thing: RLS. With Row Level Security on every table, the browser talking to Supabase directly is the intended design; the database is the backend. Without RLS, your friend is right and everyone can read everything.

You need a server only for things that must stay secret from the browser: third-party API keys, payments, sending email. For plain CRUD on your own tables, RLS is the backend.