So very much this. The reason we're using OAuth in the first place is that we're leaving authentication to the big companies that know how to do it well.

The sheer amount of support work that resetting passwords and fixing access issues (and dealing with hostile actions) generates for a small team is staggering.