I'd actually say the opposite. Any small start-up is not likely to have the expertise to implement auth in a 100% spec compliant, HIPAA certified, SSO compatib

I'd actually say the opposite. Any small start-up is not likely to have the expertise to implement auth in a 100% spec compliant, HIPAA certified, SSO compatible manner. It's not a de-facto BAD-THING to outsource skills outside of the niche of a business, and is likely more secure and thought-out than what would be created otherwise.