Users of applications in the dba_users table?

I've read a bit of the AskTom site and searched through the archives on this. It seems that the recommendation is to write a procedure that creates actual Oracle users and then have applications log into the database and use Oracle's security, and roles? Am I reading this correct?

Now, if this is the case,

1. How does one handle millions of customers?
2. How does an application handle connection pooling, because in this case, it seems there wouldn't be any.

Thanks.

-- 
Galen deForest Boyer
Sweet dreams and flying machines in pieces on the ground.