They don't need their own in-house bespoke infrastructure, the hard part is user identity, and there are many services that will host this for you and also integrate seamlessly with third party providers (Firebase, for example, which will let you identify via Google, Meta, GitHub, Twitter, etc. right out of the box)
The difference between Firebase and Ethereum+metamask isn't a significant development cost for anything beyond a toy weekend project.
The difference is only about trust.
The argument you want to make is that we shouldn't trust Firebase, they could steal our auth tokens and act on our behalf without our permission, so we need trustless decentralized solutions.
That would be a valid argument, but a hard sell to an audience that doesn't buy the premise. I'm not going to debate it.
However, it has nothing to do with the technical layer of auth which is just "prove that you know the secret" in all cases.
Either you don't understand how this works, or you're deliberately avoiding the point.
Where do you think Metamask stores your private key?
It would be trivial for Firebase to release a browser extension that used LocalStorage to store the secret, like Metamask, instead of regular web storage.