Is data injected into a HTTPS POST response secure from the client? [closed]

Question

When developing web apps it's often common practice to inject variables into, and reference them from, a current POST request - for example, Laravel's merge() helper exists to do exactly this - and it's easier to do this and pass the variables through with the response than to do so separately.

If I inject data into my HTTPS POST requests/responses in this way and then pass that response back to the view, can these variables be considered secure, or are they able to be seen on the client-side?

I'm questioning this right now because I recently read somewhere that HTTPS requests are only encrypted in transit (as opposed to end-to-end) in order to prevent MITM attacks, which seems to imply that they are unencrypted on the ends themselves. If this is true, it would mean that the user is able to see them on the client-side, making data sent to them insecure.