I didn't want to go point for point but I started writing and this will be my last reply:
AB engineering and security is way better from the outside looking in.

NGP does have a contribution form product so I think it's a fair comparison. Also comparing UI, speed, API, and willingness of staff to communicate and work together is fair IMHO. I've found and seen AB fix security critical bugs. the AB UI is pretty good and most important the donate pages & donate api is fast and I've never experienced catastrophic failure over many years when it matters. AB is also great to work with, quick, willing to listen and work together. NGPVAN on the other hand...

I agree on the compliance that's what I wrote I think they have that moat and while I think it would be fairly easy to make a better product I dont think it would be easy for a new product to get compliance correct right out of the gate (which is what would need to happen).

the actual (now kind of combined UI design) NGP VAN UI I think is poor and even basic queries / lookups are slow. i also think in terms of toolset there is a lot of room for innovation (e.g. from voter contacts ML for me similar voters, better leverage data across platforms, and much more I dont want to write publicly since we offer some of these patchwork services ourselves). if you've ever had to use their email platform that alone speaks for itself to this point...

plus ngpvan routinely suffers from 'going down for maintenance' or 'adding capacity' during peak problems that from the outside looking in seem to come from legacy tech/problems.

The VAN side of API does allow more data in, NGP not at all. I can't add any custom data to users, I can only tag an external ID and add what's basically a tag to a person. Most important I can't get donation data out. Last I talked to them I kind of off hand mentioned I could script against their internal api and they shut me down with TOS. While the VAN API does at least allow for some data in, the export jobs you give are pretty limiting imho and maybe even an example of legacy choices or internal fears I can't tell I dont work there. a counter example for AB is we subscribe to webhooks which POST json of all incoming data; even the idea of an NGPVAN API is somewhat new if I remember.. trying to scratch head I think I remember NGP only accepted like XML SOAP requests not that long ago (like a cycle or two). Whenever I do data work with VAN first step I do is export it all and dump into bigquery lol.

the thing with managing voter data is that I dont think the party provides as much value as they could (should). anyone can get voter file data either through state SOS or buy it from one of many companies; you mention a few. i dont think the party does a good job of collecting and using data across clients across cycles and i think there are a few R for-profits that do a better job at generating value here; but there are a lot of obstacles e.g. each campaign wants to control their own data, what about primaries, etc. for instance you dont see the party enabling/selling 3rd party targeting via oracle on issue scores collected from voter contacts across clients across cycles like a few R companies have done.

Campaigns have not replaced email with signal no matter how hard tech people want them too it's just not the same functionality and use case as email. in the case of sending a temporary password idk seems apples to oranges as a 'one time secret' link in the end just dont want someone who gains access to email to also gain access to plaintext passwords which are routinely emailed (but idk maybe there is a better solution which is why I asked). even if did have signal in the first place, prob dont have on the computer they are trying to login on (copy and paste password)