Order matching, order execution, credit and limit controls, reporting, multiple APIs and interfaces for order entry, market data and many other things supporting everything from legacy FIX clients coming over leased lines to modern restful web APIs and SBE over websockets, identity management with highly complicated RBAC model for traders and firms (who can trade what on behalf of whom under which conditions), highly complex and robust logging especially for regulatory requirements, maintaining alignment with regulations across the globe...

And if you think normal end users are picky you haven’t met traders that still want to use a 25 year old keyboard with non-standard ASCII codes that’s barely recognized as an HID device on your new electron based trading frontend and if you can’t accommodate for that they will leave.

So you have millions of clients all of which are adversarial and you have to maintain market fairness and integrity to ensure no manipulation is possible with trillions of dollars on the line that can be wiped off in a heartbeat and that is before you start thinking about nation state actors who would love to be able to cause major economic damage to the US, Europe and other major western economies.