Where the data is stored. Firebase "may process and store your data anywhere Google or its agents maintain facilities", and Analytics has no EU data residency option. For a company that has to answer that question in a procurement form or a DPA, no feature makes up for it.
It is Google. Behavioural data about your users sits with an advertising business. That is a position rather than a defect, and for a lot of teams it is the entire reason they are reading this page.
App and web are two different products. Firebase Analytics measures apps; the web side is GA4, a separate console with a separate data model. A product that ships both ends up with two tools and no single answer.
Consent. Firebase stores an app-instance identifier on the device, and Google's own guidance is that app IDs fall under privacy laws and need consent. Wiring that properly is work, and doing it badly is worse than not having analytics.
The 500-event ceiling. Not the usual reason, but a real one: 500 distinct event names is generous until a logEvent call takes a dynamic string and eats the budget in a week.