When scrolling beyond the client-side buffer (which covers a few rows outside of the visible window), the table UI widget requests a consecutive set of rows with a start index and a “page length” from the server side component. The server side Table component then makes a series of requests to the container to fetch that data, effectively requesting consecutive items in order.
If your data source does not support efficient random access, you could implement an indexed container that internally fetches data in consecutive “pages” from a back-end data source and presents it as a random access data table/list with some caching. Item identifiers can be e.g. running numbers, in which case a read-only container just needs to be able to tell the data set size and fetch items (rows) from it by index (and implement a few methods on top of that functionality). A writable container needs to provide a few more operations. This should eliminate the need for paging on the table level in most cases.
In theory, you could also use a surrogate ID to trigger fetching of additional data if you want to force the browsing order or if that is required by the back-end data source. The ID may get fetched already when approaching the end of the table due to the small client-side buffer/cache, though, and there may be other complications.
As for Spring, Vaadin itself is a back-end agnostic framework. Many of the Spring frameworks can be and are being used with Vaadin, although the documentation is still rather thin on that (
Spring Integration
).
Tutorials and other documentation might be needed more than actual code changes to support Spring, which is very modular and designed so that its higher layers can be replaced easily.
For data access, so far Hibernate is the best supported data source, but different projects have their own container implementations for various back-end frameworks. A JPA container is being planned.
For the leakage concern, I assume you think about accidental exposure of internal information to the end user of a system.
Vaadin being a server-side framework, DAOs are commonly used in the server-side part of the UI, but only the information actually shown in the components gets transmitted to the web browser of a user. This makes avoiding exposing internal data much easier than in client-side frameworks - most of the time, nothing needs to be done.
If you are overly concerned about this, or the lower layers do not trust the implementation of the UI layer, you could always create another service layer (and related containers etc.) between a Vaadin UI and the underlying layers.