A website with no login system can not make Twitch API requests as they require an OAuth token.
To get an OAuth token you need to use one of the OAuth flows, which for a client-side app (which a website is, whether it’s static or dynamically generated HTML) would be the implicit auth flow, as both the Auth Code flow and the Client Credentials flow require a backend server.
If you were to just generate a token yourself, and put it into the site, that site MUST not be public or accessible by anyone else, otherwise it would be a violation of the developer agreement as you can’t share tokens like that. Also like I previously mentioned you would need to keep updating the site each time the token expires where as if you use an auth flow you can just have the user seamlessly go through it each time they load the page (or use sessions so they only go through it as needed).
Yes, but that code has to run somewhere, ie a server, and they’re making a client-side app so that’s not applicable in this situation.