XSRF, rate limiting, permissions/RBAC, feature toggles/TIP, analytics, profiling, silly examples like recent samesite changes - Just a few examples, and that's without touching the developer tooling.

As each of these orthogonal concerns starts drifting in, applications become more and more complex as they 'tack on' support for these in code, rather than having structures in place to allow for extensions and modifications.

Abstractions always have their cost. Complexity exists in the problem domain of the web, and always will. .NET Core is generally well architected in response to a long experience in enterprise and developer concerns. It's not a magical answer to every domain's requirements, but it's generally a damn good compromise ime.