With some work, even most simple applications can scale to thousands of active users.
When talking about scaling, opinions vary, as do the orders of magnitude in question: someone's system might run well with a hundred active users, someone else might need to serve thousands, whereas yet another organization might be working with tens of thousands of users and beyond. Personally, I haven't had to work with the latter outside of particular load testing circumstances, but even most boring real world systems can be optimized to perform better for gradual scaling up.
What I did
I've done plenty of this over the years, sometimes you need to store users in an instance of Redis so that the DB wouldn't be hit whenever you need to validate some roles or permissions. Other times you need to cache public resources that won't change often much but will be available whenever you open the site, to allow other parts of it to work better. Maybe some bits of code deep within the application haven't been written optimally and you actually can get away with some caching and cache invalidation in front of the ORM.
Other times, things get a little bit more complicated, you might need to change the architecture itself to allow the application to scale horizontally, so you can easily meet the capacity demands, at least up to a point where further optimizations are necessary. You'll eventually need to think along the lines of managing backpressure, queues, async processing and sometimes look into CQRS altogether, so you can split up various parts of the system for better scaling, as well as other benefits.
What I learnt
A lot of these aspects have been application specific, none have been incomprehensibly hard once you got into researching the problems and solutions, yet even governmental systems have failed with lower loads. Regardless, this is the sort of work that, when combined with appropriate APM solutions, can be fairly rewarding because the results are immediately visible.
Note that in very few cases the actual choice of language or runtime have been the "end all, be all" considerations, whereas a lot of the time it's instead a matter of what the algorithms and chosen data structures, as well as other mechanisms are.