I think there's value in both. Consider Duo. They took a common problem - authenticating servers and services with 2FA - and made it easy to add to existing infrastructure. There's not really a consumer use for this product, aside from maybe a VPN, but there's absolutely a huge demand for it in business.

I worked on many CRUD apps that had say 4 different groups of users. We made a library / system for determining what "level" a user is, based on what Active Directory roles the user is assigned. In the application, you can show or hide components based on this level. Making some sort of middle-ware that abstracts things for developers, so they don't have to think about things like AD, is a huge area of opportunity.