I've rolled my own before (including implementing several distinct F500 SSO variants atop it). I'm sympathetic to the benefits of that, but I think most Web developers would get the nuances of it wrong, to the point of increasing both system downtime and security vulnerabilities.

That said, I recently went to add off-the-shelf JS/TS authn to a new SvelteKit app, looking at a few different packages, and was surprised how rough it was to do any method other than sell out your users to adtech companies just a little bit more. (The last off-the-shelf auth framework I used, for Python Flask, was more straightforward to add, and for a rich feature set.) So there seems to be an opportunity to do better.