>but then you are offloading all the issues of JWT's to Auth0 so in theory, probably not in practice, you don't have to worry about those.

Yeah, exactly. I get to offload everything to Auth0 instead of maintaining a cryptographer on our payroll to reimplement a solved problem. Hand rolled OSS authz/n may work for individual projects, but there's no other reasonable solution in a modern enterprise environment with SSO.