Angular + .NET Core Web API + Cookie Authentication + Same Domain = Secure?

I have yet to find an example of Angular authentication using a .NET Core Web API backend and cookie authentication. I discovered back in 2019 that as long as the angular SPA is being served from the same domain as the API, it is "OK" to use cookie authentication.

Reference: https://damienbod.com/2019/01/20/is-a-spa-less-secure-than-a-server-rendered-web-application/

Angular

const credentials = {
    UserName: userName,
    Password: password
};
this.httpClient.post<AuthorizationInfo>(url, credentials, { withCredentials: true });

.NET Core 5.0 Web API (code stripped for brevity)

(startup.cs)
            // Configure cookie authentication.
            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options => {
                options.Cookie.Name = AUTH_COOKIE_NAME;
                options.Cookie.SameSite = SameSiteMode.Strict;
                options.Cookie.HttpOnly = true;
                options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
                options.Cookie.IsEssential = true;
                options.SlidingExpiration = true;
            });

(AuthenticationController.cs)
[HttpPost]
public async Task<AuthorizationInfo> Login([FromBody] UserInfo credentials)
{
    if (this.authenticationStore.Authenticate(credentials.UserName, credentials.Password))
    {
        // ... (claims)

        // Create the user's identity and create an authorization cookie.
        ClaimsIdentity claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
        await this.HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity), new AuthenticationProperties() {
            IsPersistent = true
        });

        return new AuthorizationInfo() {
            UserName = user.UserName,
            Roles = roleNames
        };
    }
    else 
    {
        // ...
    }
}

With the above implementation, once the authentication is successful, the client will send the cookie upon all other requests, and the entire thing works perfectly and is amazingly simple.

The million dollar question is: Is there something fundamentally wrong with the above approach, such that is bad practice to mix SPA and cookie authentication on the same domain? Can you provide any online evidence to back up your assertions?

I already aware of the argument that serving your application and identity logic from the same application is not good practice. Besides that, I've searched high and low for any evidence that suggests the above implementation is "bad practice" but I have not found any. Absence of evidence does not imply it is a good pattern, or, not a "bad pattern." Every Angular or SPA example I see uses separate identity servers or services, tokens, oidc, etc.

Bonus: Are there any non-fundamental, but inherent aspects/risk one should be aware of with this approach that should be mitigated, such as CSRF, etc.? (Any links are appreciated, but not required, as the question is very broad).