Verifying that your vendor hasn't done anything dumb is hard. Supporting your customers when they have problems is hard. Debugging issues with a thrird party

Verifying that your vendor hasn't done anything dumb is hard. Supporting your customers when they have problems is hard. Debugging issues with a thrird party in the loop is hard. Just because you farmed out auth doesn't mean you get to stop monitoring for breaches, or doing all the other things you need to do to have an eye on security. Farming out auth just ads a recurring cost per user and complexity that your going to ignore till its a bigger issue than dealing with this up front would have ever been.