That's the nature of these add-ins. Modern Add-ins are all little XML frames with some JS or whatever. All processing occurs server-side, hosted by the add-in publisher.
This is counter to the old (security nightmare) COM model where processing could be local.
This is counter to the old (security nightmare) COM model where processing could be local.