Earlier quoted context omitted.
>Remember that the most economical tool for the job is often not the coolest or trendiest - but is some old boring workhorse that other engineers will scoff at. When I read this, a voice in my head yelled PHP.
These days Ruby on Rails is fairly orderly as well.
https://www.wyc.io/posts/just-build-it-in-django-or-rails/
It's just really hard to beat the reliability, community, ecosystem, and features that are table stakes when using a competent web framework.
When you're poking at a new market, you really don't have time to give a shit about writing CSRF middleware. That's one less customer interview or feature request to grow your business. I'm sure you can do it, and no one's doubting your capability to do so. But these are just things that are tricky to implement and takes everyone time and effort to do so correctly.