BFF is not great for long term security, notably token binding. It's hard enough to bind an artifact to the browser session from the IDP - having each app implement binding passthrough from browser to app to IDP is even worse.