This all depends what your goal is.
If your goal is to understand web development then I would say that a micro-framework like Flask is better because you actually have to assemble all the pieces yourself. Moreover, if you're curious about how a given feature is implemented, extension source code is often very accessible. For example, all the business logic in Flask-Login is confined to one ~450 line Python file [1]. Not bad!
But one the other hand, if you're trying to create a production-ready service, then Django/Rails probably have fewer risks since they require fewer decisions.
Lastly, the book had a very thorough treatment of authentication. I agree that this is a huge pitfall, and I think Miguel introduced and explained the problem extremely well.
[1] https://github.com/maxcountryman/flask-login/blob/master/fla...