If you do roll your own and you’re not a high value target (aka there aren’t a lot of assets they can seize or are a notorious criminal) nobody is going to take the time to bust open your homegrown setup. Security by obscurity is powerful. There is a reason why Wordpress sites get hacked a lot: the exploit has a lot of leverage with 1/4 to 1/3 of the public web using it.
