This is why we need hardened authentication services that can be selfhosted. Ory Kratos seems like its going in the right direction.

proprietary auth - not even once