So how do developers e.g. add a new field to the User schema if needed for the business? Or customize the login page? Or ...

Now you have a CMS like Wordpress, no longer a library or even framework, which has so many moving parts that is def not "secure by default".