The key is doing it deliberately. Know what you are trading off, isolate the risk, and avoid baking shortcuts into the core system.
Win the customer if you must, but do it in a way that lets you recover fast rather than paying for it for the next year.
The "isolate the risk" part is where most early CTOs underestimate the blast radius. A shortcut in the auth layer feels isolated until six months later when three other systems are built on top of assumptions it makes. By then it's not a shortcut anymore, it's load-bearing technical debt.
What's the recovery actually looked like in practice when you've caught it early enough — do you get clean rewrites or is it mostly containment?