From my perspective, it isn’t the security aspects that are limiting, but the usability. If you want to have any access controls that isn’t a simple user_id==1

From my perspective, it isn’t the security aspects that are limiting, but the usability. If you want to have any access controls that isn’t a simple user_id==123, SQL WHERE clauses can get complicated. Users, groups, or any kind of fine grained access control can make simple queries non-trivial. It’s even worse if a user can be authorized to view data across different accounts.