“This flexibility is one reason for confusion when it comes to OAuth.”
OAuth exists so apps stop asking for your Gmail password. It’s a set of specs that delegates login and access to someone else with limited tokens. The specs don’t technically cover authentication, which is what everyone uses it for. That gap is why developers get it wrong. A vendor wrote the clearest guide, and of course it sells an OAuth server.