Passive income hurdles:
* change in the commission you get, this happened on many platforms. I personally experienced going from 50% commission to 15% commission
* your domains could be attacked by international link farm botnets (national police ignores this), causing your income to tank. This is happening to my domains now. It's a brick wall of law enforcement, domain registrars, domain hosting etc ignoring this crime. Then it's a problem of scale, should you as a solo developer go after 100.000 botnet domains? Google disavow tool is way to slow to solve the problem, even after reporting spam domains they're there for 2+ months
* dealing with international cyber crime in general. Because national law doesn't apply to the world, you are pretty much on your own when it comes to security. The internet is the wild wild west, crime is the norm.
* you could be kicked of the platform like App store, Play store for unspecified reasons. Maybe you made apps that provide you a nice passive income, then poof, gone.
* your co-founder could sue you (if you don't work solo)
Active income hurdles:
* customer goes bankrupt
* customer refuses to pay
* a pandemic could disrupt your business
Overall active income is better, because the passive income problems are much harder. Passive income is awesome when it works, but it's not a guaranteed income and it's outside your control.
Start with an advertisement. Either trough an advertising platform (google ads etc) or by contacting companies directly (linkedin). Something like "need a website? yada yada yada"