A sweet spot only is as much as the code is already written, but there's a huge amount of ops and security work that goes into rolling your own auth.

For 99.9% of businesses, don't roll your own auth. Just don't do it. Use an auth service.