I had the same learnings with cognito when using it for a product we built.

We mainly choose it because AWS was used anyway and the security aspect seemed to be solved entierly with this coice (if aws get's hacked ... ).

We regretted it out of similar reasons.