What you're saying is correct, but oh boy have I worked on Django apps that have had awful security issues because of this. "look, all my endpoints are there, user A must only be able to reset their own password... right? ;)"

Also you don't have to miss those days! You can still use Django or a similar library? I still use Flask, it is great.