A huge blocker I didn't grok at the beginning is API keys. Unless the app interacts with 0 services, at all, you need edge functions that essentially just add an API key header to a request from the client.
It offends me because I don't want people to have to trust me, but...there isn't anyone who will recommend otherwise. :/