You can limit the damage though; in theory there’s no reason why authentication needs to be centralised. You could split the backend up into multiple authentica

You can limit the damage though; in theory there’s no reason why authentication needs to be centralised. You could split the backend up into multiple authentication services and “bucket” the auth requests per email address or something. So essentially make a bunch of different authentication services that can fail independently. I’m sure they have good reasons for not doing that though.