Not fully open source and run by a tiny startup that last raised funding 3 years ago means it's way too risky to use in a real product. Firebase and Cognito have issues, but for something as mission critical to a product as auth and identity knowing the service won't be killed or acquired is too important.