Sorry, but I don’t agree.
Perhaps you know django and you can manage a web server and you are a database administrator and you have time to waste going through all the hoops required to create a secure app.
I have done some of that in the past, and I know enough to know that I don’t know enough. My old apps look great, but I’m sure they are not safe. I don’t know enough and I’m not interested in going back wasting time learning all those things only to end up with huge security holes that I can’t see because I don’t know enough.
Your points make sense if you have a large team building a large app. Most of us Anvillistas work solo or in very small teams, and enjoy delegating all security concerns to the Anvil team.
The few times I saw security holes when comparing Anvil apps to django apps the holes were on the django side. Perhaps you can get a HIPAA certified app with django and you can’t with Anvil, but if you get your advice about security from this forum, then please stay away from HIPAA apps!