> where NextAuth seems to have a preachy disclaimer about how email and password is inherently insecure

Yeah I needed a login & password auth last friday and I was so frustrated with NextAuth I ended up using nginx to set up http basic auth.