Counter point: How many paid auth providers force you to create an entirely new deployment and then use a lambda to migrate within their own system? Especially for something as seemingly simple like adding another metadata field?
I think they allow export because they drew some interesting lines around their own mutability concerns.
I also would never use cognito again.
https://docs.aws.amazon.com/cognito/latest/developerguide/co...