I would expect authorization and validation to be a real pain with PostgREST (I don't know enough about it to tell definitively, though).

Even row-level access control, while not widespread any way, is often not enough. Complex validation in SQL can be done, of course, but SQL isn't exactly meant for these things, IMHO.