I've worked in both android and spring boot and rewriting your security to use a filter chain is nothing* compared to the shenanigans google likes to pull. Keeping up with the deprecations and imaginary "best practices" is half the job. It's like someone combined the worst parts of react with the worst Java timeline and forced people to write inscutable spaghetti that's completely impractical/impossible to test.

*there are valid criticisms of spring security, but I think this particular change improved things, even if it felt pointless