Implement row-level security as a user table or millions of roles?
With that many users, it's probably only practical to manage it using a shared role with your own user table. In fact, I know of very few consumer-facing applications that manage their users using database roles. The thing is, you almost certainly need to store more information per user than what Postgres stores for roles. So if you just manage your users as data in your own table, you're done. But if you have to create a role for each user too, then you're increasing the work you need to do. So I'd stick with a user table.