My understanding is the security enforcer can only be added to the parent page so it can’t be used to protect the SPA content page which is effectively protecting the link within it to the content pages.
If someone manually types in the SAP route to bypass this then as it points to a invalid browser page (i.e. only has content but lacks headers etc) it can’t be accessed directly without a 404 error being generated.
Not really sure how you could get around this, if at all. It may be you have to accept the 404 error page in the event of someone effectively trying to hack your content.
I personally am not an SPA expert, there are others here far more knowledgeable about them