My understanding from this is that in the background each user would be fetching from the API from their own IP since the calls appear to be front-end
Yes, this is correct. Calls originate from the user browser and the standard rate limits apply.
but at some point don't the Splinterlands API servers 429?
This happens from time to time. We just try to not overwhelm the API with too many calls 😁