The increased security of these more sophisticated authentication systems comes at a price and increased management complexity. Once you choose an authentication mechanism, many Web application packages can integrate with it and take care of authorization based on the user's identity. This is usually sufficient. However, you should be aware that Web application products often do all database access through a single database user account. This makes the database easier to manage, but it makes it much more difficult to monitor user access and contain any intrusion.
Security is all about tradeoffs.
How much security you need depends entirely on the specific nature of your application, your business and your user community. Historically, Web site designers and staff who operate these sites have prioritized ease of use, ease of administration and performance ahead of security. Don't expect this prioritization to change any time soon. Realistically, it won't change until strong authentication and fine-grained authorization are well integrated into the basic building blocks of Web sites, so that no explicit security tradeoff needs to be made at all. In the interim, securing Web sites comes down to mastering the fundamentals.