Hey, let's be fair here: Rails also doesn't have built-in authorization. You need something like Pundit or CanCanCan if you don't want to built it yourself.

Also Rails only recently got authentication. For more than a decade you needed Devise or something else.