Good survey. Two things worth pulling out of the lists since they're the ones that actually bite. Connection pooling: once Server Components and Server Actions run on a serverless platform, every concurrent invocation can open its own DB connection and Postgres has a hard max_connections. Without a pooler in front (PgBouncer, Prisma Accelerate, a Neon/Supabase pooled endpoint) you hit connection exhaustion under real traffic, not in dev.

And Server Actions aren't just "not magic backend", each one compiles to a public POST endpoint with a stable ID that anyone can call directly with any arguments. So "this action is only invoked from my form" is never true. The auth check and the Zod parse inside every action are load-bearing, not defense in depth.