True. But, if persona has a large and active open source community, it might be better to use that than maintain homegrown solution in the hope of "security by obscurity".
There are some strong auth/auth open source communities - https://github.com/Jasig that serve millions of users.