1. Biggest issue with serverless is debugging when you can't make a local environment and can't install anything like a conventional debugger in the serverless environment. I know of at least one company with a new and very elegant solution for this problem.
2. Visibility and monitoring is also a challenge and there are a bunch of serverless monitoring startups.
3. Security is interesting because, again, you can't install anything to protect your code: no Web Application Firewalls, for example. And there are several interesting theoretical attacks on serverless apps. Already, there are specialist serverless security companies.
A lot of companies don't 'migrate' to serverless. They use a Lambda or GCP Function to handle one small part of a backend task like image processing or some other form of backend tooling. Serverless is often just a good way of gluing other microservices together.