I don't mean to imply that it should be everywhere, rather it is appealing as an option when the only other option is to roll your own setup.

It's useful for connected services, orgs, etc. Especially when it comes to easily setting up access controls. But you're right, it's not a solution that should be used everywhere due to the fact that a single point of failure is bad.

Btw this has been a great discussion and I hope that others reading this might help further the goal of creating a safer internet