Auth is hard to get right, fiddly at the best of times, and is no one's core competency.

It's almost always part of the box not the chocolates, and so is an excellent candidate for outsourcing. I can see why companies attack this space.