I beat this horse to death, but I would definitely use it for if there was just a way to allowlist / vpc-peer so the functions can be the only thing talking to the database. Password isn't enough for a lot of applications.

As long as vercel has lame security, I'll consider it a toy, nice for quick jokey blogs and stuff but not something to use for a serious project. Not about to risk getting sued just to use vercel simply because your stuff's easy to use