is it better to have a backend for Supabase or does it matter to have everything on the frontend?

It depends on your use-case. There's nothing really forcing you to use Supabase on the front-end. For example, if you really wanted to, you could have an Express-js server which has sessions, and handles auth to Supabase via routes. Likewise, you could have everything running on the front-end if it's easier.

If you do it in a backend, the performance would drop, right?

There'll be some overheads (network latency to your server, and then an additional hop to the Supabase server), but generally it shouldn't be significantly worse. Again, it depends on your use case. Front-end use seems to be the most common and I'd say it's the recommended approach, but there's no doubt some use cases out there where handling things on server-side would be better.

for example, if you have roles is it better to make a backend?