We're a big fan of dogfooding - everything in Supabase is built with Supabase except (as you correctly point out) the Auth.
> How does Supabase auth compare to just using auth0?
Supabase Auth is the result of only 6 weeks of development, so we have a long way to go to catch up with Auth0 features/stability. We'll get there though!