Shopify won because a merchant can go live without a development team. Themes, payments and apps are there on day one. The risk is the same as with any platform: you outgrow the defaults without noticing.
Start simple
One theme. Official payments. A handful of products with real photos and shipping rules. Do not install an app for a problem you do not have.
What breaks later
Taxes, inventory, email flows, and checkout apps that fight each other. Plus exists for teams that already feel the ceiling — not as a status buy.
Security
Shopify is PCI-aware. You still own access, staff accounts and the apps you grant. Review them like you would review plugins.