Authentication - Don't think about security, don't think about risk, don't think about what you are protecting and whether it is worth it, just make sure the user can not log in, and VOILA, it is secure:
A month and a half ago, I ordered a peter powel kite. Ebay lost the parcel, I got in touch with the seller, but I can not get in touch with Ebay to get a refund, as they have provided no mechanism to do so.

Ebay has not visibly updated their user interface on their site in the last 15 years, and their interface is not fit for purpose. I write web software, and I could fix this if I was writing their site. I have several clients, and I recognise and fix interface issues that contradict user service. The fact that an issue such as this where they promise a guarantee that in effect means nothing is endemic on a huge swindle that is the modern IT industry. It frustrates me that these companies that should have large budgets for ongoing maintenance rest on their laurels because they have a monopoly.nI could write a replacement for ebay in several months. Same goes for Facebook or anything Google produces. In fact, I could get a 1st year computing student to write a replacement for these, other than the user base for these products is established, they have no other advantage

Apple on their iPhone have an introduced bug where you can not block nusance calls until you add them to your contacts, and the process of doing this in an interface where you could easily accidentally call the number concerned by brushing against the wrong control. Any QA of this feature should IMMMEDIATELY see the problem with this, and any competent develpoment team should fix it.

I keep track of errors using Sentry. It gives me information that allows me to fix the problem and get in touch with the staff member or patron to apologise and let them know something is being done. I use "sizzy" to identify CSS/JS interface issues on multiple devices. I regularly log in to my servers, update them, reboot them, check on their load. I collect IP addresses of requests, and block any that are accessing URLs that are obviously hacker intrusion attempts, or use a simple algorithm to recognise DOS attemtps. This is not rocket science, it is obvious, but people prefer to use CloudFlare, because they don't want to understand how it works.

Complexity is a balance. I don't go down to machine instructions on multiple hardware bases and write my own version of Java and expect it to be adopted, but I do use the right tool for the right job. In this industry the right tool is what is marketed best, and the result are pages that are slower to load and less secure.

I do this leading a very small team, and it is reflected in the appreciation my client gets from its patrons and staff. They love me for it. Well, it looks like the competition is not going to compete, because they are so full of their own hubris, they do not feel the need to provide customer service.