Look at most of the stories on the front-page of HN these days. Often some shiny tool to allow front-end JS devs to write and deploy full-stack applications automatically upon commit. I guarantee you they’re making similar newbie mistakes. Instead of SFTP it’ll be a serverless endpoint that returns entire User records, unhashed password and all, without any sort of auth check.
I'd rather risk it with the newbies, modern stacks usually have good tutorials and standard solutions to most security sensitive problems.
Last time I dodged a product because its website looked like it was designed in the early 2000's it was SolarWinds just over a year ago..
I’m feeling nostalgic remembering helping clients migrate away from their breached shared hosting around the turn of the century, especially how this ended up being cheaper because GoDaddy was way over market rates.
And of course, every API key and secret was just hanging out in the repo as well.