Nothing wrong about keeping a monolith if it doesn't get in the way.
At my clients, the typical case is that the "product" consist of an assembly of services where some have been written and some bought so being able to span homogenous access controlls over them is a nice feature of JWTs/OIDC :-)
I resisted microservice mania when it emerged, and now I feel validated that the pendulum has swung back.