Arguably if you're just building prototypes then integration with a third party provider is going to be overkill. However over the long haul you're right about

Arguably if you're just building prototypes then integration with a third party provider is going to be overkill. However over the long haul you're right about the benefits of a IAM provider. It's not only about data security but also the expanding feature set that will likely follow. Think roles, entitlements, user policies, MFA, consents and GDPR etc. Not to say you cant build this in but at some point you may consider how much time you're spending developing auth vs core product. I work for OneLogin so often spend time thinking about this and you're right that not enough devs seem to take the time to consider it.