It's not more rotten that your regular backend shop. How many api issues / auth problems / s3 open bucket there are out there exactly?
The "yes I really want to do this" confirmations you need to go through when opening up a bucket these days are about 4 deep...
Authn/z issues are real though, they'll never be fixed