Turn off access to the internet on your TV (or never give it), use a good android box (no china crap) or Apple TV.

Buy a computer monitor as big as possible (42" non ultrawide as far as I can find). Otherwise if you are in an isolated area (no wifi reachable from other houses and thus TV hotspots), then you can just get a TV and block it from the internet on your router. If you are good with electronics, you can rip out the mic and/or network card or chip.

Then get an orange pi 5 pro/plus/ultra with a rockchip RK3588/RK3588S if they are ever fucking available again, and put plasma bigscreen on it.

Or if you are more tech savvy, hook up a recycled newish Intel laptop motherboard, slap a heatsink and fan on, 3D print a chassis, get a power supply, and throw plasma big screen on it.

IMHO, I kinda agree with their decision. I see basic auth as just that, user and pass. Anything else should use a proper solution, and there are tons of excellent options.

Isn't that generally what external auth providers are designed for?

I imagine it isn't much of a concern if Immich isn't exposed to the internet.

If you want to go the extra mile, you can roll immich with Autelia / Authentik etc. IDP, and use TOTP on that layer.

I'm working on them - hopefully next!