Both auth and notifications get extraordinary complex at even minimal scale. Obviously each business needs to decide which areas make sense to invest from tech perspective but LinkedIn and AirBnB each spend around $20m/year just on their notification systems.
FWIW given GDPR, CCPA, et al so do auth & communication. I'd honestly have a big problem with our team wanting to store passwords ourselves...
You don't store passwords.
And regarding GDPR, I have problems giving sensible data to third parties. Another point of failure and no control for me what happens to the data.