All the companies I worked with in the last 15 years had custom auth (all bcrypt in the end).

Nothing bad ever happened. They're still rocking the same system and the only notable change that went through was adapting to gdpr deletion requests. And they all avoided that okta hack from some time ago.

What's expensive mistake are you talking about?