Interestingly enough, from what I can gather, most APIs are using services that manage EOAs with some kind of MPC/other security infra to manage private keys.

It seems all of the AA stuff is built primarily for frontends, but I don't think this is a given. Might just FAFO on using it for a backend service.

It's true that most APIs rely on services for managing private keys. While AA tools are designed for frontends, they could potentially be utilized for backend services as well. Security remains a top priority in both cases.