Best practice regarding security in jQuery

That's correct. Typically, there would be some kind of checks on the server-side to determine if the form that is submitted is empty, and if not then sanitize the inputted data from the form. If the form that was submitted had empty required fields then the server would probably redirect to the page with the form (the page the user just came from).

It is good practice to attempt to catch any submission requirements in JavaScript before anything is sent to the server. This is good for UX because the pages aren't being refreshed (AJAX not being considered here) as often so the user has a more fluid experience because of reduced latency from client->server communication.

However, as you mentioned, if the user has JavaScript turned off then there needs to be a plan in place on the server to redirect the request if the request has not been fulfilled. The server should always be sanitizing any data sent to it from a form for security.

Redundancy is pretty key here. e.g. Attempt to catch errors in JavaScript before data is sent from client to server. Yet, also check the data once it's been sent to the server as well because the server should never assume that JavaScript is enabled.