How do I return a HTTP 404 status code from a SPA?
Use window.location to redirect to a proper 404 page. However, I'm not sure if Google will follow it and it's already discouraged to change the URL.
Your assumption is not correct. Google will be very fine if you redirect to a proper 404 page (or a 410). Google will follow it and will be very happy with this information. It wants to know about bogus URLs to make sure these won't be included in their rankings. They will love it !!!
As a reminder, and although it is not the preferred way to perform a redirect, Google accepts and follows pages having a Refresh tag with its delay set to 0, because, in some tricky cases, there is simply no other way to perform a redirect. This is the recommended method for Blogger pages (owned by Google).
Google follows.