ANY abstraction of security or other services from the MAIN api application is equally vulnerable; I have verified this with multiple vendors who have all stated the same thing : "Move security back into the api application".

In which case, what is the gateway for? It is merely a load balancer... and an ACTUAL load balancer does the job better and faster.