Don't take this personally, but - I don't believe you. I've never seen complex abstractions that didn't leak. Maybe the feature is worth the complexity, I don't know, but I can't fault the authors for thinking not.
Authentication, authorization, and security in general are complex problems that are demonstrably difficult to get right. Any solution is going to have implementation complexity. The comment you responded to was actually describing a way to manage that complexity.
