+1 for talking about attack surface. Every service is a potential gateway for bad people. Locking them all down is incredibly difficult to get right.

99.99% of startups and SMEs should not be writing microservices.

But "I wrote a commercial system that served thousands of users, it ran on a single process on a spare box out the back" doesn't look good on resumes.