The React example given at the end misses out on one issue where even linters can't help: fetching data and accessing its contents. Setting aside error handling (fetch call fails), the response data could have a different schema than what the code expects.

This is what parsers are for (in TS: zod, valibot, joi, yup et al). Preferably those that can express type definitions for their output that matches the runtime validation.

You can't have type-safety without untrusted input parsing.