> Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.

Indeed but it forces you to answer these questions and to think about them during the development process as well, maybe even enough to write decent unit and regression tests for anything authentication/authorization related before some security "researcher" siccs Claude Code or whatever on your API and pwns it.