Repo seems to be private: Any of the options have their pros and cons so you can create a hybrid implementation to mitigate, here are some of the multi-program applications you can adopt:
Marinade Finance: uses single core program + satellite programs for specific domains. You can check how they handle admin authority vs operational authority (the core program has a council multisig as admin, but a PDA for stake withdraw operations). Also, the referral program is a wrapper that CPIs into the main program
Marginfi: uses group-based isolation with shared program
Ellipsis Labs: uses core program + auxiliary programs that CPI into core. The phoenix-v1 is the core orderbook while the seat manager and market maker programs CPI into it
Common Pitfalls:
Trusting invoker program ID blindly — Just because a CPI came from Program X doesn't mean Program X verified the user. Always re-check relevant signers. Forgetting that PDAs don't persist signer status across instructions — A PDA that signed in instruction 1 is not automatically a signer in instruction 2 unless you CPI with invoke_signed again. Centralized upgrade authority — If all programs share an upgrade authority, your modularity is illusory. Consider multisigs.