>most founders bring experts on-board

You have way too much faith my friend. How does bringing an authentication and security expert into your organization make you more money? It doesn't. What people like this tell you change is all cost and only hypothetical benifit. I suspect this doesnt happen anywhere near as much as it should.

You don’t bring “experts” on board. Most of them really aren’t. At most, you find a third party trusted managed service.

I work in mostly the B2B space where we integrate with their Identity Providers (active directory, Okta, etc) and strongly discourage them from using our internal authentication system so they have to take responsibility for their own security.

If I were working in the consumer space, I would personally use AWS’s Cognito since that’s what I’m familiar with and it integrates with everything - Google, Facebook, Twitter, Apple, Amazon etc.

I’m sure there are other services that serve similar functions.

Hey, I meant to reply on your other comment asking for third party trusted services.

Thanks for listing some, will look into them!

Auth0 is another.

>Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them.

Strong contender for Most Horrifying Thing I've Read This Morning.

It's good practice to consider the likelihood of attack in your threat model if you care about the expected payoff associated with your security efforts.

When that threat model necessarily includes bored script kiddies and automated APTs?

Exactly. Like if user privacy does not matter but just cold cash. Thanks to statements like this there is GDPR.